CVE-2026-127081
Received Received - Intake

Authorization Bypass in BuildPiper Pipeline Stages

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127081
EUVD
EUVD-2026-125101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpsTree Solutions BuildPiper From 0 (inc) to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127081 is an authorization bypass vulnerability in OpsTree BuildPiper versions before 2.7.0. It allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. The flaw exists in the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint where the server fails to validate ownership of the environment, enabling cross-project associations that bypass intended project separation.

The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a medium severity rating with a CVSS score of 5.3.

Detection Guidance

To detect this vulnerability, monitor API requests to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint for unauthorized environment associations. Check logs for requests with foreign project_env_id values. Validate if responses include cross-project environment links without proper ownership checks.

Impact Analysis

This vulnerability could allow unauthorized users to execute pipeline jobs against environments outside their authorized project. Attackers could access infrastructure resources tied to other projects, potentially leading to data leakage or unauthorized actions. The impact includes bypassing project-level separation and running attacker-controlled artifacts in unauthorized environments.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data across projects, violating data isolation requirements in GDPR and HIPAA. It may result in unauthorized processing or exposure of personal health information or other regulated data, potentially causing compliance breaches and legal consequences.

Mitigation Strategies

Immediately update BuildPiper to version 2.7.0 or later to address the authorization bypass. Review pipeline stage configurations for unauthorized cross-project environment links. Implement server-side validation to ensure environment ownership matches pipeline project ownership.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...