Improper Authorization in OpsTree BuildPiper Allows HostPath Volume Abuse

Executive Summary

CVE-2026-127080 is an improper authorization vulnerability in OpsTree BuildPiper versions before 2.7.0. It allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without restrictions. Attackers can set the host path to the root filesystem (/) to mount it read-write, breaking container isolation and enabling full node and cluster compromise.

Useful 0 Not Useful 0

Detection Guidance

Check BuildPiper version with: kubectl get deployments -n <namespace> -l app=buildpiper -o jsonpath='{.items[*].spec.template.spec.containers[0].image}' | grep -E 'buildpiper|opstree'

Inspect Kubernetes deployments for hostPath volumes: kubectl get deployments --all-namespaces -o json | jq '.items[].spec.template.spec.volumes[] | select(.hostPath)'

Audit BuildPiper logs for unauthorized hostPath configurations in deployment requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive host files, write arbitrary files to the host filesystem, access data from other workloads on the same node, and establish persistence for further attacks. A single compromised deployment could lead to full worker node and potentially cluster-wide compromise.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade BuildPiper to version 2.7.0 or later immediately to patch the vulnerability.

Disable user-defined hostPath volumes in BuildPiper configurations by default.

Implement Pod Security Standards or admission controllers to block unauthorized hostPath mounts.

Enforce allow-lists for safe hostPath volumes and reject sensitive paths like /, /etc, /var/run.

Useful 0 Not Useful 0