CVE-2026-54167
Received Received - Intake

Authentication Bypass in Pipelines-as-Code GitHub App

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54167
EUVD
EUVD-2026-78587

Affected Vendors & Products

Showing 13 associated CPEs
Vendor Product Version / Range
github pipelines-as-code 0.37.8
github pipelines-as-code 0.39.6
github pipelines-as-code 0.42.1
github pipelines-as-code 0.48.0
github pipelines-as-code to 0.37.8 (exc)
github pipelines-as-code to 0.39.6 (exc)
github pipelines-as-code to 0.42.1 (exc)
github pipelines-as-code to 0.48.0 (exc)
tektoncd pipelines-as-code 0.37.8
tektoncd pipelines-as-code 0.39.6
tektoncd pipelines-as-code 0.42.1
tektoncd pipelines-as-code 0.48.0
tektoncd pipelines-as-code to 0.48.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pipelines-as-Code allows an unauthenticated attacker to manipulate the X-GitHub-Enterprise-Host header in webhook events to redirect GitHub App token requests to a malicious host. The system trusted this header without validating it against the repository URL, enabling potential credential exfiltration. The issue is fixed by validating webhook signatures before token generation and deriving the enterprise host from the repository URL instead of the header.

Detection Guidance

Check your Pipelines-as-Code controller logs for suspicious webhook events or unauthorized GitHub App token requests. Monitor for unexpected X-GitHub-Enterprise-Host headers in webhook payloads. Verify your installed version is not vulnerable (0.37.8, 0.39.6, 0.42.1, or 0.48.0 or later).

Impact Analysis

An attacker could exploit this to steal GitHub App JWT tokens, which may allow them to mint installation access tokens within the token's validity window. This could grant unauthorized access to repositories or resources controlled by the GitHub App, depending on its permissions. The impact is high for confidentiality as sensitive tokens are exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized token access may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Upgrade to patched versions 0.37.8, 0.39.6, 0.42.1, or 0.48.0 immediately. Block or strip unexpected X-GitHub-Enterprise-Host headers at your ingress. Rotate GitHub App private keys if exploitation is suspected. Restrict webhook access to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart