Skip to content
Fencer Vulns
medium 6.5

CVE-2026-54168 json

Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

published 2026-08-20 2 mo ago modified 2026-09-30 39 d ago also GHSA-6f2p-296r-cc28 , GO-2026-6263 , EUVD-2026-78586

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

Patch / fix

  • go github.com/openshift-pipelines/pipelines-as-code 0.37.8, 0.39.6, 0.42.1, 0.48.0
  • govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1

suse advisories SUSE-SU-2026:23625-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1

opensuse advisories openSUSE-SU-2026:21761-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54168 updated cvss 6.5

github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: Information disclosure via unscoped GitHub App installation token

  • Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-rhel9-operator, openshift-builds/openshift-builds-rhel10-operator Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines-client 1.15.3-11580.el8, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel8-operator, openshift-pipelines/pipelines-rhel9-operator, +12 more Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-clients 1.17.0-4.el9, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9 Red Hat Web Terminal web-terminal/web-terminal-tooling-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
53 d ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/openshift-pipelines/pipelines-as-code
<0.37.8
>=0.38.0, <0.39.6
>=0.40.0, <0.42.1
>=0.43.0, <0.48.0
0.37.8
0.39.6
0.42.1
0.48.0

Affected products

  • tektoncd pipelines-as-code

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.