EUVD-2026-78586
GHSA-6f2p-296r-cc28
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Push access (PR:L) to any installation repository is required; impact is read-only confidentiality with no integrity or availability loss.
Primary rating from Vendor (https://github.com/tektoncd/pipelines-as-code).
CVSS VectorVendor: https://github.com/tektoncd/pipelines-as-code
Lifecycle Timeline
2DescriptionCVE.org
Impact
When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation.
This allows a user with push access to any repository in the installation to craft a PipelineRun with a remote task annotation pointing at a private repository in the same installation:
pipelinesascode.tekton.dev/task: "https://github.com/org/private-repo/blob/main/.tekton/secret-task.yaml"Pipelines-as-Code resolves and inlines the remote task using the unscoped token, exposing the contents of the private repository's Tekton definitions. This is a read-only confidentiality breach, no write access is exposed.
Patches
The fix extracts the repository ID from the webhook payload during initial parsing so that it is available for later use. It then adds a fallback in the client setup path so that when no explicit scoping configuration is present and ScopeTokenToListOfRepos returns empty, the token is re-issued scoped to the triggering repository's ID rather than retaining access to the entire installation. The initial token remains unscoped so that the extra-repos lookup can still discover and resolve additional repositories when configured.
The fix is available in v0.48.0. Supported backport releases will be added here after release tags are published.
Workarounds
Limit the GitHub App installation to only the repositories that require Pipelines-as-Code. Avoid org-wide installations or mixed-trust installations where repositories with different access requirements share the same GitHub App. This restricts the blast radius of the unscoped token to only the repositories that are explicitly selected during App installation.
Credits
Reported and fixed by the Pipelines-as-Code maintainers.
AnalysisAI
Unscoped GitHub App installation token exposure in Tekton Pipelines-as-Code (openshift-pipelines/pipelines-as-code) allows any authenticated user with push access to one repository in a multi-repo GitHub App installation to read the Tekton task definitions from other private repositories in the same installation. By crafting a PipelineRun with a remote task annotation pointing at a private repository URL, the attacker causes Pipelines-as-Code to fetch and inline that repository's task YAML using the over-privileged installation token during webhook processing, producing a read-only confidentiality breach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Pipelines-as-Code must be configured with a GitHub App installed across multiple repositories or org-wide - single-repository installations are not vulnerable; (2) the attacker must hold push access (write permission) to at least one repository in that GitHub App installation; (3) a target private repository containing Tekton task YAML must exist within the same GitHub App installation; (4) the attacker must be able to trigger webhook processing, which occurs naturally via a Git push to the accessible repository. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) accurately reflects the real-world risk profile: exploitation is network-reachable, low-complexity, and requires only push access to one repository in the installation - a meaningful but not trivial prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Pipelines-as-Code to one of the vendor-confirmed patched releases: v0.37.8, v0.39.6, v0.42.1, or v0.48.0 depending on the currently deployed branch; v0.48.0 is the primary upstream fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today