CVE-2026-127074
Received Received - Intake

Path Traversal in OpsTree BuildPiper

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127074
EUVD
EUVD-2026-125108

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpsTree Solutions BuildPiper From 0 (inc) to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127074 is a path traversal vulnerability in OpsTree BuildPiper versions before 2.7.0. It allows authenticated users with build configuration permissions to read arbitrary files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can exploit this by setting traversal sequences or absolute paths like /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.

Detection Guidance

Check BuildPiper versions prior to 2.7.0 for unvalidated dockerfile_path and build context inputs. Monitor build logs for unexpected file paths like /etc/passwd or ../ sequences. Review CI configuration endpoints for suspicious path manipulations.

Impact Analysis

This vulnerability can allow attackers to read sensitive files on the build worker, such as system files (/etc/passwd), secrets, registry configurations, or service-account tokens. If stored on the worker, these exposed files could lead to further compromise of the system or data breaches.

Mitigation Strategies

Upgrade BuildPiper to version 2.7.0 or later. Implement strict path validation for dockerfile_path and build context inputs. Restrict build configuration permissions to trusted users only. Review and remove sensitive files from build workers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...