CVE-2026-127081

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign projectenvid. Attackers can submit another project's environment identifier to the POST...

CVE-2026-127078

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign projectenvid. Attackers can configure CI and trigger builds and deployments through the component env...

CVE-2026-127078

OpsTree BuildPiper versions prior to 2.7.0 are vulnerable to an authorization bypass via the project_env_id parameter. This flaw allows authenticated users to attach another application's environment to their own service by providing a foreign project_env_id. By exploiting this, an attacker can a...

EUVD-2026-125104

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign projectenvid. Attackers can configure CI and trigger builds and deployments through the component env...

CVE-2026-127081

OpsTree BuildPiper versions before 2.7.0 are vulnerable to an authorization bypass (CWE-639) that allows authenticated users to bypass project separation. By submitting a foreign project_env_id to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, an attacker can link pipeline stages to en...

EUVD-2026-125101

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign projectenvid. Attackers can submit another project's environment identifier to the POST...