CVE-2026-50240

A vulnerability exists in OpenShift Pipelines-as-Code (PAC) where the system fails to verify if a Repository custom resource creator has the necessary permissions to create PipelineRuns . An attacker with only Repository and Secret create/delete permissions can trigger the execution of attacker-c...

CVE-2026-50240

A flaw was found in OpenShift Pipelines-as-Code PAC. PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns ...