Improper privilege management in backstage pipelines-as-code
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-862.
Summary
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | pipelines-as-code | before 0.37.8; 0.38.0 to before 0.39.6; 0.40.0 to before 0.42.1; 0.43.0 to before 0.48.0 | 0.37.8, 0.39.6, 0.42.1, 0.48.0 | Patch available | CNA |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | before 0.37.8 | 0.37.8 | Patch available | GHSA-6f2p-296r-cc28 |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | 0.38.0 to before 0.39.6 | 0.39.6 | Patch available | GHSA-6f2p-296r-cc28 |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | 0.40.0 to before 0.42.1 | 0.42.1 | Patch available | GHSA-6f2p-296r-cc28 |
| — | github.com/openshift-pipelines/pipelines-as-code (Go) | 0.43.0 to before 0.48.0 | 0.48.0 | Patch available | GHSA-6f2p-296r-cc28 |
- pipelines-as-code Vendorbackstage Affected before 0.37.8; 0.38.0 to before 0.39.6; 0.40.0 to before 0.42.1; 0.43.0 to before 0.48.0 Fixed in 0.37.8, 0.39.6, 0.42.1, 0.48.0 Patch available CNA
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected before 0.37.8 Fixed in 0.37.8 Patch available GHSA-6f2p-296r-cc28
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected 0.38.0 to before 0.39.6 Fixed in 0.39.6 Patch available GHSA-6f2p-296r-cc28
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected 0.40.0 to before 0.42.1 Fixed in 0.42.1 Patch available GHSA-6f2p-296r-cc28
- github.com/openshift-pipelines/pipelines-as-code (Go) Vendor— Affected 0.43.0 to before 0.48.0 Fixed in 0.48.0 Patch available GHSA-6f2p-296r-cc28
Remediation
- Fix · CNA pipelines-as-code (tektoncd) Fixed in 0.37.8, 0.39.6, 0.42.1, 0.48.0
- Fix · GHSA-6f2p-296r-cc28 github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.37.8 Advisory →
- Fix · GHSA-6f2p-296r-cc28 github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.39.6 Advisory →
- Fix · GHSA-6f2p-296r-cc28 github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.42.1 Advisory →
- Fix · GHSA-6f2p-296r-cc28 github.com/openshift-pipelines/pipelines-as-code (Go) Fixed in 0.48.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Builds for Red Hat OpenShift
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat OpenShift Dev Spaces
- Red Hat Web Terminal
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54168
- 2026-10-03 Alias added: GHSA-6f2p-296r-cc28
References
Other 10
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28
- https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
- https://github.com/tektoncd/pipelines-as-code
More backstage vulnerabilities
- TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
- TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
- TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-54168 · CVE Program
- CVE-2026-54168 · NVD
- FIRST EPSS
- GHSA-6f2p-296r-cc28 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-54168 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences