Vulnerability-Lookup

CVE-2026-54167 (GCVE-0-2026-54167)

Vulnerability from cvelistv5 – Published: 2026-09-15 14:29 – Updated: 2026-09-15 14:49

Title

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Summary

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 14:49 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M mitre root

References

9 references

URL	Tags
https://github.com/tektoncd/pipelines-as-code/sec…	x_refsource_CONFIRM
https://github.com/tektoncd/pipelines-as-code/com…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/com…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/com…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/com…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/rel…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/rel…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/rel…	x_refsource_MISC
https://github.com/tektoncd/pipelines-as-code/rel…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
tektoncd	pipelines-as-code	Affected: < 0.37.8 Affected: >= 0.38.0, < 0.39.6 Affected: >= 0.40.0, < 0.42.1 Affected: >= 0.43.0, < 0.48.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:49:51.787044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:49:57.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pipelines-as-code",
          "vendor": "tektoncd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.37.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.38.0, \u003c 0.39.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.40.0, \u003c 0.42.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.43.0, \u003c 0.48.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:29:45.535Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
        },
        {
          "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f5f4-3hh4-f54m",
        "discovery": "UNKNOWN"
      },
      "title": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54167",
    "datePublished": "2026-09-15T14:29:45.535Z",
    "dateReserved": "2026-06-11T21:46:52.380Z",
    "dateUpdated": "2026-09-15T14:49:57.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54167",
      "date": "2026-09-18",
      "epss": "0.00184",
      "percentile": "0.08268"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "pipelines-as-code",
                "vendor": "tektoncd",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.37.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.38.0, \u003c 0.39.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.40.0, \u003c 0.42.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.43.0, \u003c 0.48.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
          }
        ],
        "id": "CVE-2026-54167",
        "lastModified": "2026-09-15T15:17:17.707",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54167",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:49:51.787044Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T15:17:17.707",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-345"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-16T17:52:49+00:00",
      "cve": "CVE-2026-54167",
      "id": "CVE-2026-54167",
      "initial_release_date": "2026-09-15T14:29:45.535000+00:00",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54167.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54167",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-15T14:49:51.787044Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-15T14:49:54.564Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "pipelines-as-code",
              "vendor": "tektoncd",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.37.8"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.38.0, \u003c 0.39.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.40.0, \u003c 0.42.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.43.0, \u003c 0.48.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-345",
                  "description": "CWE-345: Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T14:29:45.535Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
            },
            {
              "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
            }
          ],
          "source": {
            "advisory": "GHSA-f5f4-3hh4-f54m",
            "discovery": "UNKNOWN"
          },
          "title": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54167",
        "datePublished": "2026-09-15T14:29:45.535Z",
        "dateReserved": "2026-06-11T21:46:52.380Z",
        "dateUpdated": "2026-09-15T14:49:57.706Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54167

Vulnerability from fkie_nvd - Published: 2026-09-15 15:17 - Updated: 2026-09-15 15:17

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
	security-advisories@github.com	https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pipelines-as-code",
          "vendor": "tektoncd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.37.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.38.0, \u003c 0.39.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.40.0, \u003c 0.42.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.43.0, \u003c 0.48.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."
    }
  ],
  "id": "CVE-2026-54167",
  "lastModified": "2026-09-15T15:17:17.707",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54167",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T14:49:51.787044Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T15:17:17.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-F5F4-3HH4-F54M

Vulnerability from github – Published: 2026-08-20 18:36 – Updated: 2026-08-20 18:36

Summary

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Details

Impact

Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint.

Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an installation.id, Pipelines-as-Code generated a GitHub App JWT and requested an installation access token before validating the webhook signature or checking that the Enterprise host matched the repository URL in the signed payload.

An attacker who can reach the Pipelines-as-Code webhook endpoint can send a crafted GitHub webhook payload containing an installation ID and set X-GitHub-Enterprise-Host to an attacker-controlled host. During token generation, the controller signs a GitHub App JWT locally and sends it to the selected API host. This can disclose the GitHub App JWT to the attacker-controlled service, allowing the attacker to attempt to mint GitHub App installation access tokens within the JWT validity window, subject to the GitHub App installation and permissions.

The incoming webhook flow also trusted X-GitHub-Enterprise-Host during GitHub App installation lookup and token generation. In that path, exploitation requires a valid incoming webhook secret for the target Repository CR.

Patches

The fix validates the webhook signature before GitHub App token generation, verifies that X-GitHub-Enterprise-Host matches the repository URL in the webhook payload, and stops using the request header to select the GitHub Enterprise host for incoming webhook token requests. For incoming webhooks, the Enterprise host is derived from the configured Repository URL instead.

The fix is available in v0.48.0. Supported backport releases will be added here after release tags are published.

Workarounds

Until a patched release is deployed, operators should block or strip unexpected X-GitHub-Enterprise-Host headers at the ingress or proxy in front of the Pipelines-as-Code webhook endpoint. For GitHub.com installations, reject requests that include this header. For GitHub Enterprise Server installations, allow only the expected Enterprise hostname.

Operators should also restrict access to the webhook endpoint to trusted Git provider sources where possible. If exploitation is suspected, rotate the GitHub App private key and review GitHub App installation token activity.

Credits

Reported and fixed by the Pipelines-as-Code maintainers.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openshift-pipelines/pipelines-as-code"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.43.0"
            },
            {
              "fixed": "0.48.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openshift-pipelines/pipelines-as-code"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.40.0"
            },
            {
              "fixed": "0.42.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openshift-pipelines/pipelines-as-code"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.38.0"
            },
            {
              "fixed": "0.39.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openshift-pipelines/pipelines-as-code"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.37.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54167"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:36:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\n\nPipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint.\n\nAffected versions accepted the `X-GitHub-Enterprise-Host` request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an `installation.id`, Pipelines-as-Code generated a GitHub App JWT and requested an installation access token before validating the webhook signature or checking that the Enterprise host matched the repository URL in the signed payload.\n\nAn attacker who can reach the Pipelines-as-Code webhook endpoint can send a crafted GitHub webhook payload containing an installation ID and set `X-GitHub-Enterprise-Host` to an attacker-controlled host. During token generation, the controller signs a GitHub App JWT locally and sends it to the selected API host. This can disclose the GitHub App JWT to the attacker-controlled service, allowing the attacker to attempt to mint GitHub App installation access tokens within the JWT validity window, subject to the GitHub App installation and permissions.\n\nThe incoming webhook flow also trusted `X-GitHub-Enterprise-Host` during GitHub App installation lookup and token generation. In that path, exploitation requires a valid incoming webhook secret for the target Repository CR.\n\n## Patches\n\nThe fix validates the webhook signature before GitHub App token generation, verifies that `X-GitHub-Enterprise-Host` matches the repository URL in the webhook payload, and stops using the request header to select the GitHub Enterprise host for incoming webhook token requests. For incoming webhooks, the Enterprise host is derived from the configured Repository URL instead.\n\nThe fix is available in v0.48.0. Supported backport releases will be added here after release tags are published.\n\n## Workarounds\n\nUntil a patched release is deployed, operators should block or strip unexpected `X-GitHub-Enterprise-Host` headers at the ingress or proxy in front of the Pipelines-as-Code webhook endpoint. For GitHub.com installations, reject requests that include this header. For GitHub Enterprise Server installations, allow only the expected Enterprise hostname.\n\nOperators should also restrict access to the webhook endpoint to trusted Git provider sources where possible. If exploitation is suspected, rotate the GitHub App private key and review GitHub App installation token activity.\n\n## Credits\n\nReported and fixed by the Pipelines-as-Code maintainers.",
  "id": "GHSA-f5f4-3hh4-f54m",
  "modified": "2026-08-20T18:36:30Z",
  "published": "2026-08-20T18:36:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tektoncd/pipelines-as-code"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54167 (GCVE-0-2026-54167)

FKIE_CVE-2026-54167

GHSA-F5F4-3HH4-F54M

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour