Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | pipelines-as-code | before 0.37.8; 0.38.0 to before 0.39.6; 0.40.0 to before 0.42.1; 0.43.0 to before 0.48.0 | 0.37.8, 0.39.6, 0.42.1, 0.48.0 | Patch available | CNA |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | 0.43.0 to before 0.48.0 | 0.48.0 | Patch available | GHSA-f5f4-3hh4-f54m |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | 0.40.0 to before 0.42.1 | 0.42.1 | Patch available | GHSA-f5f4-3hh4-f54m |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | 0.38.0 to before 0.39.6 | 0.39.6 | Patch available | GHSA-f5f4-3hh4-f54m |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | before 0.37.8 | 0.37.8 | Patch available | GHSA-f5f4-3hh4-f54m |
- pipelines-as-code Vendorbackstage Affected before 0.37.8; 0.38.0 to before 0.39.6; 0.40.0 to before 0.42.1; 0.43.0 to before 0.48.0 Fixed in 0.37.8, 0.39.6, 0.42.1, 0.48.0 Patch available CNA
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected 0.43.0 to before 0.48.0 Fixed in 0.48.0 Patch available GHSA-f5f4-3hh4-f54m
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected 0.40.0 to before 0.42.1 Fixed in 0.42.1 Patch available GHSA-f5f4-3hh4-f54m
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected 0.38.0 to before 0.39.6 Fixed in 0.39.6 Patch available GHSA-f5f4-3hh4-f54m
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected before 0.37.8 Fixed in 0.37.8 Patch available GHSA-f5f4-3hh4-f54m
Remediation
- Fix · CNA pipelines-as-code (tektoncd) Fixed in 0.37.8, 0.39.6, 0.42.1, 0.48.0
- Fix · GHSA-f5f4-3hh4-f54m github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.48.0 Advisory →
- Fix · GHSA-f5f4-3hh4-f54m github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.42.1 Advisory →
- Fix · GHSA-f5f4-3hh4-f54m github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.39.6 Advisory →
- Fix · GHSA-f5f4-3hh4-f54m github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.37.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Web Terminal | Affected | No fix yet |
Not affected: 4 products
- Builds for Red Hat OpenShift
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat OpenShift Dev Spaces
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54167
- 2026-10-03 Alias added: GHSA-f5f4-3hh4-f54m
- 2026-10-28 10 new references · GHSA-f5f4-3hh4-f54m
References
Other 11
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
- https://github.com/tektoncd/pipelines-as-code/pull/2759
- https://github.com/tektoncd/pipelines-as-code
More backstage vulnerabilities
- TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
- TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
- TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-54167 · CVE Program
- CVE-2026-54167 · NVD
- FIRST EPSS
- GHSA-f5f4-3hh4-f54m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-54167 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences