{"id":"GO-2026-6266","revision":"088d4d5f3a314c2f8303692c21d59442","records":[{"revision":"088d4d5f3a314c2f8303692c21d59442","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6266","aliases":["CVE-2026-54167","GHSA-f5f4-3hh4-f54m"],"title":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code","description":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code","state":0,"publishedAt":"2026-08-25T19:43:10+00:00","modifiedAt":"2026-08-26T01:21:40.5363133+00:00","affected":[{"ecosystem":"Go","name":"github.com/openshift-pipelines/pipelines-as-code","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.37.8"},{"kind":"introduced","version":"0.38.0"},{"kind":"fixed","version":"0.39.6"},{"kind":"introduced","version":"0.40.0"},{"kind":"fixed","version":"0.42.1"},{"kind":"introduced","version":"0.43.0"},{"kind":"fixed","version":"0.48.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6266","license":"OSV · upstream source license applies","key":"osv:GO-2026-6266","identifiers":["GO-2026-6266","CVE-2026-54167","GHSA-f5f4-3hh4-f54m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}