GHSA-f5f4-3hh4-f54mPublished
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Exact source revision recorded 28 Oct 2026 15:48:49 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54167 · Microsoft / collected KEV context
osv · GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
- https://nvd.nist.gov/vuln/detail/CVE-2026-54167
- https://github.com/tektoncd/pipelines-as-code/pull/2759
- https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.