Skip to content
OpenAdvisories

Product · tektoncd

pipelines-as-code

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-54168

    Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

    Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that trigge…

    tektoncd pipelines-as-code github.com/openshift-pipelines/pipelines-as-code Go