CVE-2026-54167

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

EUVD-2026-78587

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54167

Pipelines-as-Code , a CI/CD system for defining Tekton pipelines in source repositories, is affected in its GitHub App provider . Prior to versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the provider accepts the X-GitHub-Enterprise-Host request header as the API host before webhook signature validat...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

EUVD-2026-78586

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-45052

creationtimestamp| type| source ---|---|--- 2026-09-15 10:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2lbrim24 2026-09-15 12:07:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvklmb5fi32g 2026-09-15 16:01:41+00:00| seen|...

CVE-2026-7646

creationtimestamp| type| source ---|---|--- 2026-09-15 08:01:49+00:00| seen| https://gist.github.com/ichintu/61eae90f050b47deb0b3d5ff8144d16f...

GHSA-GH8F-V7FJ-8CJ2

creationtimestamp| type| source ---|---|--- 2026-09-15 07:04:48+00:00| seen| https://gist.github.com/maxbro1992/6c89390c80f987e251e3979a9c98ceb6...

GHSA-9QXX-2FGC-35R8

creationtimestamp| type| source ---|---|--- 2026-09-15 07:04:48+00:00| seen| https://gist.github.com/maxbro1992/6c89390c80f987e251e3979a9c98ceb6...

CVE-2026-90843

creationtimestamp| type| source ---|---|--- 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621...

CVE-2026-91771

creationtimestamp| type| source ---|---|--- 2026-09-15 04:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621 2026-09-15 12:50:04+00:00| seen|...

CVE-2026-46696

creationtimestamp| type| source ---|---|--- 2026-09-15 01:32:02+00:00| seen| https://gist.github.com/alon710/a0fdd505cf6388a20a8132f22b04c968...

CVE-2026-49400

creationtimestamp| type| source ---|---|--- 2026-09-15 00:31:20+00:00| seen| https://gist.github.com/alon710/65b5c64d62229349e54e21de9ec5c14b...

GHSA-2FF2-MX52-Q8WP

creationtimestamp| type| source ---|---|--- 2026-09-15 00:31:20+00:00| seen| https://gist.github.com/alon710/65b5c64d62229349e54e21de9ec5c14b...

CVE-2026-16335

creationtimestamp| type| source ---|---|--- 2026-09-15 00:04:06+00:00| seen| https://gist.github.com/ichintu/bb350504840f7717d8931db615795f78...

CVE-2026-54167: Insufficient Verification of Data Authenticity

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...