8.2

CVE-2026-54167: tektoncd pipelines-as-code

CVSS: 8.2v3.1HighAwaiting analysis
AliasesGHSA-f5f4-3hh4-f54mGO-2026-6266
Published 15-09-2026Last modified 15-09-2026
Open JSON

Vulnerability summary

CVE-2026-54167 is a high (CVSS 8.2) vulnerability in tektoncd pipelines-as-code. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.8% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (CVE.org)
EPSS score
0.27%
0%100%
Low · +0.08 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2026:21761-1SUSE-SU-2026:23625-1

Timeline

  1. 15-09-2026
    PublishedVulnerability first disclosed.
  2. 15-09-2026
    Last modifiedVulnerability information updated.

Description

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

+0.08 pp

From 0.18% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Github.com/openshift-pipelines1 product
  • pipelines-as-code≥ 0.40.0, < 0.42.1 | ≥ 0.38.0, < 0.39.6 | < 0.37.8 | ≥ 0.43.0, < 0.48.0
Tektoncd1 product
  • pipelines-as-code< 0.37.8 | ≥ 0.38.0, < 0.39.6 | ≥ 0.40.0, < 0.42.1 | ≥ 0.43.0, < 0.48.0

2 vendors · 2 products

References

10 links