Tekton Pipelines-as-Code up to 0.37.7/0.39.5/0.42.0/0.47.x Token Scoping ScopeTokenToListOfRepos privileges management

Summaryinfo

A vulnerability was found in Tekton Pipelines-as-Code up to 0.37.7/0.39.5/0.42.0/0.47.x. It has been classified as problematic. This affects the function ScopeTokenToListOfRepos of the component Token Scoping. Performing a manipulation results in privileges management. This vulnerability is identified as CVE-2026-54168. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Tekton Pipelines-as-Code up to 0.37.7/0.39.5/0.42.0/0.47.x. It has been classified as problematic. This affects the function ScopeTokenToListOfRepos of the component Token Scoping. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. The summary by CVE is:

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-54168 since 06/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 0.37.8, 0.39.6, 0.42.1 or 0.48.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Tekton

Name

• Pipelines-as-Code

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.37.0
• 0.37.1
• 0.37.2
• 0.37.3
• 0.37.4
• 0.37.5
• 0.37.6
• 0.37.7
• 0.38
• 0.39
• 0.39.0
• 0.39.1
• 0.39.2
• 0.39.3
• 0.39.4
• 0.39.5
• 0.40
• 0.41
• 0.42
• 0.42.0
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion