Codefresh EUVD-2026-65354

Exploitation requires a valid authenticated session on the Codefresh platform - the attacker must possess an existing account of any permission tier within the target organization. No non-default feature flag, special deployment mode, or specific configuration setting is described in the advisory as a prerequisite beyond authentication. The vendor-supplied CVSS 4.0 vector sets PR:H (high privileges required), which conflicts with the plain reading of 'authenticated user' in the description; if any authenticated user qualifies, the practical barrier is simply holding a valid credential. Exploitation is bounded to users who have obtained credentials for the target Codefresh organization - unauthenticated external actors cannot directly exploit this flaw.

The vendor-supplied CVSS 4.0 vector scores 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), indicating full confidentiality, integrity, and availability impact within the Codefresh platform via a low-complexity, network-accessible path. A material discrepancy exists: the vector sets PR:H (high privileges required), yet the description states any 'authenticated user' can exploit the flaw - if any developer or contributor account qualifies, the effective PR should be L, which would represent a more severe real-world risk than the vendor score reflects. No EPSS data was provided in the input and cannot be independently cited here. CISA KEV status is not confirmed, and no public exploit code has been identified. Despite the absence of confirmed active exploitation, the combination of network reachability, low attack complexity, and complete platform takeover capability makes this a genuine priority for any organization running Codefresh: Admin access to a CI/CD platform directly threatens software supply chain integrity by enabling malicious modification of build pipelines and exfiltration of embedded secrets.

An attacker with a standard Codefresh developer or contributor account sends a crafted API request to the privilege escalation endpoint. The platform grants Admin permissions without verifying entitlement. The attacker then uses Admin access to read all secrets embedded in pipelines, modify build definitions to inject malicious payloads into software artifacts, or provision additional backdoor accounts for persistent access.