{"id":"EUVD-2026-78586","enisaUuid":"c51a57ae-ea8e-3699-bfa2-4c42daf00083","description":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository\u0027s Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.","datePublished":"Sep 15, 2026, 2:27:44 PM","dateUpdated":"Sep 17, 2026, 2:30:57 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28\nhttps://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c\nhttps://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e\nhttps://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc\nhttps://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0\n","aliases":"CVE-2026-54168\nGHSA-6f2p-296r-cc28\n","assigner":"GitHub_M","epss":0.59,"enisaIdProduct":[{"id":"4e247e74-b6b1-3153-b085-1e0355b839de","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"\u003c 0.37.8"},{"id":"5acbafcf-2454-3ee0-9c3b-631f07550429","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"0.38.0, \u003c 0.39.6"},{"id":"cde58f87-ea3c-3331-8cef-7e29abd50572","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"0.43.0, \u003c 0.48.0"},{"id":"f18b98d7-b761-3e64-aa51-f8f8ed712856","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"0.40.0, \u003c 0.42.1"}],"enisaIdVendor":[{"id":"4c54cf79-6bb3-34ea-9c80-6a36fa8c253c","vendor":{"name":"tektoncd"}}],"enisaIdVulnerability":[{"id":"23604076-7be2-33e7-8d04-2a7a85f5af71","vulnerability":{"id":"CVE-2026-54168","description":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository\u0027s Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.","datePublished":"Sep 15, 2026, 2:27:44 PM","dateUpdated":"Sep 17, 2026, 2:30:57 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28\nhttps://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c\nhttps://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e\nhttps://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc\nhttps://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0\n","enisa_id":"EUVD-2026-78586\n","assigner":"GitHub_M","epss":0.59,"dataProcessed":"Nov 11, 2026, 7:21:55 AM","vulnerabilityProduct":[{"id":"531c79ed-4ef8-36c1-b40c-78bc00f0ed2c","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"0.43.0, \u003c 0.48.0"},{"id":"6a6d7180-cce0-3105-a5f7-b276117fa105","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"0.40.0, \u003c 0.42.1"},{"id":"bd153e52-cfbb-3ca0-af4d-f1f3e8de8ed5","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"\u003c 0.37.8"},{"id":"cf0df279-49f6-3713-8826-1ecae24c4e97","product":{"name":"pipelines-as-code","vendor":{"name":"tektoncd"}},"product_version":"0.38.0, \u003c 0.39.6"}],"vulnerabilityVendor":[{"id":"0adecca2-3f56-36e5-aaa7-f6d8f1d647fd","vendor":{"name":"tektoncd"}}]}},{"id":"73d08c07-0d3f-3b7b-8ae0-1180162d785b","vulnerability":{"id":"GHSA-6f2p-296r-cc28","description":"Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution","datePublished":"Aug 20, 2026, 6:36:40 PM","dateUpdated":"Aug 20, 2026, 6:36:41 PM","baseScore":0.0,"references":"https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28\nhttps://github.com/tektoncd/pipelines-as-code\n","enisa_id":"EUVD-2026-78586\n","aliases":"GHSA-6f2p-296r-cc28\nCVE-2026-54168\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:51:44 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}