{"id":"GO-2026-6266","revision":null,"records":[{"revision":"e7606273fdf74932872f027082775cf0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54167","aliases":[],"title":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header","description":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.","state":0,"publishedAt":"2026-09-15T14:29:45.535+00:00","modifiedAt":"2026-09-15T14:49:57.706+00:00","affected":[{"ecosystem":"Vendor product","name":"pipelines-as-code","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"tektoncd\",\n                    \"product\": \"pipelines-as-code\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.37.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.38.0, < 0.39.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.40.0, < 0.42.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.43.0, < 0.48.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m","https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace","https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e","https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc","https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54167","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54167","identifiers":["CVE-2026-54167"]},"retained":false,"historicalAffected":[]},{"revision":"0a2e924e945942f0b4b7c582213b9767","observedAt":"2026-10-30T09:50:25.434+00:00","statement":{"source":"euvd","id":"EUVD-2026-78587","aliases":["CVE-2026-54167","GHSA-f5f4-3hh4-f54m"],"title":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing …","description":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":null}],"references":["https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m","https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace","https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e","https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc","https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78587","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 2:29:45 PM","dateUpdated":"Sep 15, 2026, 2:49:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78587","identifiers":["EUVD-2026-78587","CVE-2026-54167","GHSA-f5f4-3hh4-f54m"]},"retained":false,"historicalAffected":[]},{"revision":"45732a5751bf4d40b277704611fcab91","observedAt":"2026-10-25T13:17:22.268+00:00","statement":{"source":"nvd","id":"CVE-2026-54167","aliases":[],"title":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing …","description":"Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.","state":0,"publishedAt":"2026-09-15T15:17:17.707+00:00","modifiedAt":"2026-09-30T17:43:24.057+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace","https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e","https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc","https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0","https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54167","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-345"],"productCriteria":[],"sourceDates":{"published":"2026-09-15T15:17:17.707","lastModified":"2026-09-30T17:43:24.057"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54167","identifiers":["CVE-2026-54167"]},"retained":false,"historicalAffected":[]},{"revision":"d2190ed3b95a4fff8474e9395173cd15","observedAt":"2026-10-28T15:48:49.17+00:00","statement":{"source":"osv","id":"GHSA-f5f4-3hh4-f54m","aliases":["CVE-2026-54167","GO-2026-6266"],"title":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header","description":"## Impact\n\nPipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint.\n\nAffected versions accepted the `X-GitHub-Enterprise-Host` request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an `installation.id`, Pipelines-as-Code generated a GitHub App JWT and requested an installation access token before validating the webhook signature or checking that the Enterprise host matched the repository URL in the signed payload.\n\nAn attacker who can reach the Pipelines-as-Code webhook endpoint can send a crafted GitHub webhook payload containing an installation ID and set `X-GitHub-Enterprise-Host` to an attacker-controlled host. During token generation, the controller signs a GitHub App JWT locally and sends it to the selected API host. This can disclose the GitHub App JWT to the attacker-controlled service, allowing the attacker to attempt to mint GitHub App installation access tokens within the JWT validity window, subject to the GitHub App installation and permissions.\n\nThe incoming webhook flow also trusted `X-GitHub-Enterprise-Host` during GitHub App installation lookup and token generation. In that path, exploitation requires a valid incoming webhook secret for the target Repository CR.\n\n## Patches\n\nThe fix validates the webhook signature before GitHub App token generation, verifies that `X-GitHub-Enterprise-Host` matches the repository URL in the webhook payload, and stops using the request header to select the GitHub Enterprise host for incoming webhook token requests. For incoming webhooks, the Enterprise host is derived from the configured Repository URL instead.\n\n## Workarounds\n\nUntil a patched release is deployed, operators should block or strip unexpected `X-GitHub-Enterprise-Host` headers at the ingress or proxy in front of the Pipelines-as-Code webhook endpoint. For GitHub.com installations, reject requests that include this header. For GitHub Enterprise Server installations, allow only the expected Enterprise hostname.\n\nOperators should also restrict access to the webhook endpoint to trusted Git provider sources where possible. If exploitation is suspected, rotate the GitHub App private key and review GitHub App installation token activity.\n\n## Credits\n\nReported and fixed by the Pipelines-as-Code maintainers.","state":0,"publishedAt":"2026-08-20T18:36:30+00:00","modifiedAt":"2026-10-28T15:45:10.969788+00:00","affected":[{"ecosystem":"Go","name":"github.com/openshift-pipelines/pipelines-as-code","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.43.0"},{"kind":"fixed","version":"0.48.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/openshift-pipelines/pipelines-as-code","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.40.0"},{"kind":"fixed","version":"0.42.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/openshift-pipelines/pipelines-as-code","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.38.0"},{"kind":"fixed","version":"0.39.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/openshift-pipelines/pipelines-as-code","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.37.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m","https://nvd.nist.gov/vuln/detail/CVE-2026-54167","https://github.com/tektoncd/pipelines-as-code/pull/2759","https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace","https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e","https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc","https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3","https://github.com/tektoncd/pipelines-as-code","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1","https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"],"sourceUrl":"https://github.com/advisories/GHSA-f5f4-3hh4-f54m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f5f4-3hh4-f54m","identifiers":["GHSA-f5f4-3hh4-f54m","CVE-2026-54167","GO-2026-6266"]},"retained":false,"historicalAffected":[]},{"revision":"088d4d5f3a314c2f8303692c21d59442","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6266","aliases":["CVE-2026-54167","GHSA-f5f4-3hh4-f54m"],"title":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code","description":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code","state":0,"publishedAt":"2026-08-25T19:43:10+00:00","modifiedAt":"2026-08-26T01:21:40.5363133+00:00","affected":[{"ecosystem":"Go","name":"github.com/openshift-pipelines/pipelines-as-code","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.37.8"},{"kind":"introduced","version":"0.38.0"},{"kind":"fixed","version":"0.39.6"},{"kind":"introduced","version":"0.40.0"},{"kind":"fixed","version":"0.42.1"},{"kind":"introduced","version":"0.43.0"},{"kind":"fixed","version":"0.48.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6266","license":"OSV · upstream source license applies","key":"osv:GO-2026-6266","identifiers":["GO-2026-6266","CVE-2026-54167","GHSA-f5f4-3hh4-f54m"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-31T06:45:36.0139128+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-31T06:45:36.0139128+00:00","lastSuccessAt":"2026-10-31T06:45:36.1619032+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:36.1619043+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9266d7b009bf9c4a0ccdcb5cbdea7f905cb3c4d92fd3b41581ece16b2cfdc4e7-7018a7a91bdbe7a328c3977e056f4a7eac81e7fe5f6abb4ce52489f9898b901e","complete":true,"records":417507,"lastAttemptAt":"2026-10-31T06:45:34.9578964+00:00","lastSuccessAt":"2026-10-31T06:45:34.914523+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:34.9578964+00:00","snapshotPublishedAt":"2026-10-31T06:29:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c5eb069e059248ab9c1b8cc754ce0885","complete":true,"records":13565,"lastAttemptAt":"2026-10-31T06:46:02.4218689+00:00","lastSuccessAt":"2026-10-31T03:47:38.206+00:00","error":null,"lastVerifiedAt":"2026-10-31T03:47:38.206+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-31T06:45:36.0139128+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-31T06:45:36.0139128+00:00","lastSuccessAt":"2026-10-31T06:45:36.162633+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:36.162633+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-baa1edd11e5d417f9e457e6720b3ba8a","complete":false,"records":13577,"lastAttemptAt":"2026-10-31T06:46:01.8200614+00:00","lastSuccessAt":"2026-10-31T06:46:01.815+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:46:01.815+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-10-31T06:45:35.6109386+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:35.6109386+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-31T06:45:35.0971204+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:35.0971204+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-10-31T06:45:35.9834827+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:35.9834827+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-3ce2e3336768d0abd5b020f6f12bd5502a5deb02700e9d89d279597dce6e72ae","complete":true,"records":230992,"lastAttemptAt":"2026-10-31T06:45:35.4897459+00:00","lastSuccessAt":"2026-10-31T03:47:08.0119269+00:00","error":null,"lastVerifiedAt":"2026-10-31T06:45:35.4897459+00:00","snapshotPublishedAt":"2026-10-31T03:03:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}