Skip to content
OpenAdvisories

Package · Go

github.com/openshift-pipelines/pipelines-as-code

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.2
    CVE-2026-54167

    Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

    Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events cont…

    tektoncd pipelines-as-code github.com/openshift-pipelines/pipelines-as-code Go
  • Medium 6.5
    CVE-2026-54168

    Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

    Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that trigge…

    tektoncd pipelines-as-code github.com/openshift-pipelines/pipelines-as-code Go