CVE-2026-54167Published
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54167 · Microsoft / collected KEV context
cve-program · CVE-2026-54167
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
euvd · EUVD-2026-78587
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
nvd · CVE-2026-54167
- https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
osv · GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
- https://nvd.nist.gov/vuln/detail/CVE-2026-54167
- https://github.com/tektoncd/pipelines-as-code/pull/2759
- https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace
- https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
- https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
- https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
- https://github.com/tektoncd/pipelines-as-code
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1
- https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0
osv · GO-2026-6266
Related operational evidence
Explicit CVE identifiers- Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header · Advisory content revised · 28 Oct 2026