CVE-2026-54168
Received Received - Intake

Information Disclosure in Pipelines-as-Code

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54168
EUVD
EUVD-2026-78586

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
tekton pipelines-as-code 0.37.8
tekton pipelines-as-code 0.39.6
tekton pipelines-as-code 0.42.1
tekton pipelines-as-code 0.48.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54168 is a vulnerability in Pipelines-as-Code, a CI/CD system for Tekton pipelines. When a GitHub App is installed across multiple repositories, the token created during webhook processing is not scoped to the triggering repository. This allows a user with push access to any repository in the installation to access private repository Tekton definitions by crafting a PipelineRun with a remote task annotation pointing to a private repo. The impact is read-only disclosure of Tekton definitions without write access.

Detection Guidance

To detect this vulnerability, check the version of Pipelines-as-Code installed on your system. Run: kubectl get deployment -n pipelines-as-code -o yaml | grep image: | awk '{print $2}' to check the image tag. If the version is below 0.37.8, 0.39.6, 0.42.1, or 0.48.0, the system is vulnerable.

Impact Analysis

If you use Pipelines-as-Code with a GitHub App installed across multiple repositories, an attacker with push access to any repo in the installation could read Tekton pipeline definitions in private repositories. This exposes sensitive CI/CD configurations but does not allow modification or write access to those repositories.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized read access to private repository contents, including sensitive data or configurations. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. The read-only breach of private repositories may expose such data, violating confidentiality requirements in these regulations.

Mitigation Strategies

Upgrade Pipelines-as-Code to versions 0.37.8, 0.39.6, 0.42.1, or 0.48.0 or later to address the unscoped token issue.

Limit the GitHub App installation to only necessary repositories to reduce the scope of the unscoped token.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart