Search
Find a vulnerability
Search criteria
4 vulnerabilities found for pipelines-as-code by tektoncd
CVE-2026-54168 (GCVE-0-2026-54168)
Vulnerability from nvd – Published: 2026-09-15 14:27 – Updated: 2026-09-17 14:30
VLAI
EPSS
VEX
Title
Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Summary
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:30 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/tektoncd/pipelines-as-code/sec… | x_refsource_CONFIRM |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tektoncd | pipelines-as-code |
Affected:
< 0.37.8
Affected: >= 0.38.0, < 0.39.6 Affected: >= 0.40.0, < 0.42.1 Affected: >= 0.43.0, < 0.48.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:30:42.954463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:30:57.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines-as-code",
"vendor": "tektoncd",
"versions": [
{
"status": "affected",
"version": "\u003c 0.37.8"
},
{
"status": "affected",
"version": "\u003e= 0.38.0, \u003c 0.39.6"
},
{
"status": "affected",
"version": "\u003e= 0.40.0, \u003c 0.42.1"
},
{
"status": "affected",
"version": "\u003e= 0.43.0, \u003c 0.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository\u0027s Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:27:44.344Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
}
],
"source": {
"advisory": "GHSA-6f2p-296r-cc28",
"discovery": "UNKNOWN"
},
"title": "Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54168",
"datePublished": "2026-09-15T14:27:44.344Z",
"dateReserved": "2026-06-11T21:46:52.381Z",
"dateUpdated": "2026-09-17T14:30:57.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54167 (GCVE-0-2026-54167)
Vulnerability from nvd – Published: 2026-09-15 14:29 – Updated: 2026-09-15 14:49
VLAI
EPSS
VEX
Title
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Summary
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:49 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/tektoncd/pipelines-as-code/sec… | x_refsource_CONFIRM |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tektoncd | pipelines-as-code |
Affected:
< 0.37.8
Affected: >= 0.38.0, < 0.39.6 Affected: >= 0.40.0, < 0.42.1 Affected: >= 0.43.0, < 0.48.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:49:51.787044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:49:57.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines-as-code",
"vendor": "tektoncd",
"versions": [
{
"status": "affected",
"version": "\u003c 0.37.8"
},
{
"status": "affected",
"version": "\u003e= 0.38.0, \u003c 0.39.6"
},
{
"status": "affected",
"version": "\u003e= 0.40.0, \u003c 0.42.1"
},
{
"status": "affected",
"version": "\u003e= 0.43.0, \u003c 0.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:29:45.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
}
],
"source": {
"advisory": "GHSA-f5f4-3hh4-f54m",
"discovery": "UNKNOWN"
},
"title": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54167",
"datePublished": "2026-09-15T14:29:45.535Z",
"dateReserved": "2026-06-11T21:46:52.380Z",
"dateUpdated": "2026-09-15T14:49:57.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54167 (GCVE-0-2026-54167)
Vulnerability from cvelistv5 – Published: 2026-09-15 14:29 – Updated: 2026-09-15 14:49
VLAI
EPSS
VEX
Title
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Summary
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:49 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/tektoncd/pipelines-as-code/sec… | x_refsource_CONFIRM |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tektoncd | pipelines-as-code |
Affected:
< 0.37.8
Affected: >= 0.38.0, < 0.39.6 Affected: >= 0.40.0, < 0.42.1 Affected: >= 0.43.0, < 0.48.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:49:51.787044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:49:57.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines-as-code",
"vendor": "tektoncd",
"versions": [
{
"status": "affected",
"version": "\u003c 0.37.8"
},
{
"status": "affected",
"version": "\u003e= 0.38.0, \u003c 0.39.6"
},
{
"status": "affected",
"version": "\u003e= 0.40.0, \u003c 0.42.1"
},
{
"status": "affected",
"version": "\u003e= 0.43.0, \u003c 0.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:29:45.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
}
],
"source": {
"advisory": "GHSA-f5f4-3hh4-f54m",
"discovery": "UNKNOWN"
},
"title": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54167",
"datePublished": "2026-09-15T14:29:45.535Z",
"dateReserved": "2026-06-11T21:46:52.380Z",
"dateUpdated": "2026-09-15T14:49:57.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54168 (GCVE-0-2026-54168)
Vulnerability from cvelistv5 – Published: 2026-09-15 14:27 – Updated: 2026-09-17 14:30
VLAI
EPSS
VEX
Title
Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Summary
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:30 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/tektoncd/pipelines-as-code/sec… | x_refsource_CONFIRM |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/com… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
| https://github.com/tektoncd/pipelines-as-code/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tektoncd | pipelines-as-code |
Affected:
< 0.37.8
Affected: >= 0.38.0, < 0.39.6 Affected: >= 0.40.0, < 0.42.1 Affected: >= 0.43.0, < 0.48.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:30:42.954463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:30:57.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines-as-code",
"vendor": "tektoncd",
"versions": [
{
"status": "affected",
"version": "\u003c 0.37.8"
},
{
"status": "affected",
"version": "\u003e= 0.38.0, \u003c 0.39.6"
},
{
"status": "affected",
"version": "\u003e= 0.40.0, \u003c 0.42.1"
},
{
"status": "affected",
"version": "\u003e= 0.43.0, \u003c 0.48.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository\u0027s Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:27:44.344Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
},
{
"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
}
],
"source": {
"advisory": "GHSA-6f2p-296r-cc28",
"discovery": "UNKNOWN"
},
"title": "Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54168",
"datePublished": "2026-09-15T14:27:44.344Z",
"dateReserved": "2026-06-11T21:46:52.381Z",
"dateUpdated": "2026-09-17T14:30:57.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}