CVE-2026-127077

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with clusterid and namespaces values. Attackers can modify requests to POST /api/v1/project/projectid/env/ to target...