Skip to content
Fencer Vulns
high 8.2

CVE-2026-54167 json

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

published 2026-08-20 2 mo ago modified 2026-10-28 11 d ago also GHSA-f5f4-3hh4-f54m , GO-2026-6266 , EUVD-2026-78587

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

Patch / fix

  • go github.com/openshift-pipelines/pipelines-as-code 0.37.8, 0.39.6, 0.42.1, 0.48.0
  • govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1

suse advisories SUSE-SU-2026:23625-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1

opensuse advisories openSUSE-SU-2026:21761-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54167 updated cvss 8.2

github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-rhel9-operator, openshift-pipelines/pipelines-operator-proxy-rhel8, openshift-pipelines/pipelines-operator-proxy-rhel9, openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8 Red Hat Web Terminal web-terminal/web-terminal-tooling-rhel9
    affected: workaround, no fix available
  • Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-rhel9-operator, openshift-builds/openshift-builds-rhel10-operator Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines-client 1.15.3-11580.el8, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel8-operator, openshift-pipelines/pipelines-operator-webhook-rhel8, +8 more Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-clients 1.17.0-4.el9, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
55 d ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/openshift-pipelines/pipelines-as-code
>=0.43.0, <0.48.0
>=0.40.0, <0.42.1
>=0.38.0, <0.39.6
<0.37.8
0.48.0
0.42.1
0.39.6
0.37.8

Affected products

  • tektoncd pipelines-as-code

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.