CVE-2026-54168
Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Timeline
ID reserved
By GitHub_M
- 3 months later
· 3 months later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.59% · top 52% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
- affected < 0.37.8
- affected >= 0.38.0, < 0.39.6
- affected >= 0.40.0, < 0.42.1
- affected >= 0.43.0, < 0.48.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/openshift-pipelines/pipelines-as-codeGHSA-6f2p-296r-cc28 (opens in a new tab)
References (9)
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3 (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8 (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6 (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1 (opens in a new tab)x_refsource_MISC
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-6f2p-296r-cc28 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-54168)Record last updated .