CVE-2026-127073

OpsTree BuildPiper versions before 2.7.0 are susceptible to a privilege escalation vulnerability. The flaw exists in the Additional Manifest feature, which fails to restrict submitted manifests. An attacker with project user privileges can submit a ClusterRoleBinding to link a service account to ...