CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

[
  {
    "vendor": "tektoncd",
    "product": "pipelines-as-code",
    "versions": [
      {
        "version": "< 0.37.8",
        "status": "affected"
      },
      {
        "version": ">= 0.38.0, < 0.39.6",
        "status": "affected"
      },
      {
        "version": ">= 0.40.0, < 0.42.1",
        "status": "affected"
      },
      {
        "version": ">= 0.43.0, < 0.48.0",
        "status": "affected"
      }
    ]
  }
]