Search
Search Results (9 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-127081 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 4.3 Medium |
| OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation. | ||||
| CVE-2026-127080 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 9.9 Critical |
| OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise. | ||||
| CVE-2026-127079 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 7.4 High |
| OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account. | ||||
| CVE-2026-127078 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 7.1 High |
| OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure. | ||||
| CVE-2026-127077 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 7.1 High |
| OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation. | ||||
| CVE-2026-127076 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 6.5 Medium |
| OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets. | ||||
| CVE-2026-127075 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 6.5 Medium |
| OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens. | ||||
| CVE-2026-127074 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 4.3 Medium |
| OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log. | ||||
| CVE-2026-127073 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 9.9 Critical |
| OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets. | ||||
Page 1 of 1.