CVE-2026-127073
Received Received - Intake

Privilege Escalation in BuildPiper via ClusterRoleBinding

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127073
EUVD
EUVD-2026-125109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpsTree Solutions BuildPiper From 0 (inc) to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127073 is a privilege escalation vulnerability in BuildPiper, a DevSecOps/CI-CD platform by OpsTree Solutions, affecting versions prior to 2.7.0. The issue lies in the Additional Manifest feature, which allows project users to submit Kubernetes manifests that the deployment pipeline applies to the target cluster with cluster-wide administrative credentials. Since the pipeline does not restrict the types of Kubernetes resources users can submit, a normal project user can create cluster-scoped RBAC objects like ClusterRoleBindings to gain full Kubernetes cluster administration rights.

Detection Guidance

Check BuildPiper versions prior to 2.7.0 by running: kubectl get deployments -n <buildpiper-namespace> -o jsonpath='{.items[*].spec.template.spec.containers[?(@.image)].image}' | grep -i buildpiper. If version is below 2.7.0, the system is vulnerable. Inspect manifests submitted via Additional Manifest feature for ClusterRoleBindings or ClusterRoles.

Impact Analysis

An attacker with project user access can escalate privileges to cluster-admin, gaining full control over all workloads and secrets in the Kubernetes cluster. This includes creating additional namespaces, accessing other applications' resources, and deploying malicious workloads. The impact is severe as it compromises the entire cluster's security.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unrestricted cluster access may result in data breaches, unauthorized modifications, or exposure of regulated data, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade BuildPiper to version 2.7.0 or later immediately. Block cluster-scoped resources by default in Additional Manifest settings. Validate manifest kinds against an allow-list. Replace high-privilege credentials with least-privilege service accounts for deployments. Implement server-side admission validation to prevent unauthorized RBAC objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127073. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...