CVE-2026-54168

A flaw was found in Pipelines-as-Code. A GitHub App installation token, created during webhook processing, is not properly scoped when the App is installed across multiple repositories. This allows a user with push access to one repository to access private repositories within the same installati...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

GO-2026-6263 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code...

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

GHSA-6F2P-296R-CC28 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

AZL-95468 CVE-2026-64652 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2025-67740

JetBrains TeamCity CVE-2025-67740 affects TeamCity before 2025.11.0, where improper access control could expose GitHub App token metadata. The connected Nessus entry notes multiple vulnerabilities in versions prior to 2025.11.0 (e.g., CVEs 67741, 67765, 68166, etc.). Remediation: upgrade to TeamC...

EUVD-2024-35272

Malicious code in bioql PyPI...

CVE-2024-35301

In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token...

CVE-2024-35301

CVE-2024-35301 affects JetBrains TeamCity versions prior to 2024.03.1. The root cause is the commit status publisher not checking the project scope of the GitHub App token, which can lead to improper permission handling. PT-Security notes the issue can enable a remote attacker to execute arbitrar...

PT-2024-3699 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.03.1 Description: The issue is related to the commit status publisher in JetBrains TeamCity not checking the project scope of the GitHub App token, which can lead to incorrect handling of insufficient...