{"id":"EUVD-2026-78586","revision":"d730286e883a48ba9ba365218a0c00a6","records":[{"revision":"d730286e883a48ba9ba365218a0c00a6","observedAt":"2026-11-11T13:59:06.844+00:00","statement":{"source":"euvd","id":"EUVD-2026-78586","aliases":["CVE-2026-54168","GHSA-6f2p-296r-cc28"],"title":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the rep…","description":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":null}],"references":["https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28","https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c","https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e","https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc","https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78586","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 2:27:44 PM","dateUpdated":"Sep 17, 2026, 2:30:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78586","identifiers":["EUVD-2026-78586","CVE-2026-54168","GHSA-6f2p-296r-cc28"]},"retained":false,"historicalAffected":[]}],"coverage":[]}