CVE-2026-127080

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount th...

CVE-2026-127079

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the checkotp endpoint, resetting the target's password and taking over the accou...

CVE-2026-127081

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign projectenvid. Attackers can submit another project's environment identifier to the POST...

CVE-2026-127076

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/gitrepo/?all=true and submit any gitrepoid to the ci endpoint,...

CVE-2026-127073

OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to...

CVE-2026-127078

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign projectenvid. Attackers can configure CI and trigger builds and deployments through the component env...

CVE-2026-127074

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfilepath and build context values. Attackers can set traversal or absolute paths such as...

CVE-2026-127077

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with clusterid and namespaces values. Attackers can modify requests to POST /api/v1/project/projectid/env/ to target...

CVE-2026-127075

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generat...

EUVD-2026-125109

OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to...

CVE-2026-127073

OpsTree BuildPiper versions before 2.7.0 are susceptible to a privilege escalation vulnerability. The flaw exists in the Additional Manifest feature, which fails to restrict submitted manifests. An attacker with project user privileges can submit a ClusterRoleBinding to link a service account to ...

CVE-2026-127075

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to a path traversal vulnerability during Additional Manifest rendering. The flaw allows authenticated users to read arbitrary files by providing traversal sequences (e.g., ../../../../etc/passwd) in the manifest file paths. This root cause...

CVE-2026-127074

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to a path traversal vulnerability. Authenticated users with build configuration permissions can read files on the build worker by providing unvalidated dockerfile_path and build context values via the CI configuration endpoint. By supplyin...

EUVD-2026-125107

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generat...

EUVD-2026-125108

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfilepath and build context values. Attackers can set traversal or absolute paths such as...

CVE-2026-127076

OpsTree BuildPiper versions prior to 2.7.0 are susceptible to a broken access control vulnerability within the git_repo API. Authenticated users can exploit this by using the GET /api/v1/git_repo/?all=true endpoint to enumerate repositories restricted to other projects. By submitting an arbitrary...

EUVD-2026-125106

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/gitrepo/?all=true and submit any gitrepoid to the ci endpoint,...

EUVD-2026-125105

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with clusterid and namespaces values. Attackers can modify requests to POST /api/v1/project/projectid/env/ to target...

CVE-2026-127077

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to an authorization bypass in the Environment Creation API. The flaw allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values during a POST request to /api/v1/pr...

CVE-2026-127078

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to an authorization bypass via the project_env_id parameter. This flaw allows authenticated users to attach another application's environment to their own service by providing a foreign project_env_id. By exploiting this, an attacker can a...