CVE-2026-54167

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54167", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T21:46:52.380Z", "datePublished": "2026-09-15T14:29:45.535Z", "dateUpdated": "2026-09-15T14:49:57.706Z"}, "containers": {"cna": {"title": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"}, {"name": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"}, {"name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"}, {"name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"}, {"name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"}, {"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"}, {"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"}, {"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"}, {"name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"}], "affected": [{"vendor": "tektoncd", "product": "pipelines-as-code", "versions": [{"version": "< 0.37.8", "status": "affected"}, {"version": ">= 0.38.0, < 0.39.6", "status": "affected"}, {"version": ">= 0.40.0, < 0.42.1", "status": "affected"}, {"version": ">= 0.43.0, < 0.48.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-15T14:29:45.535Z"}, "descriptions": [{"lang": "en", "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."}], "source": {"advisory": "GHSA-f5f4-3hh4-f54m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T14:49:51.787044Z", "id": "CVE-2026-54167", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T14:49:57.706Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T14:49:51.787044Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T14:49:54.564Z"}}], "cna": {"title": "Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header", "source": {"advisory": "GHSA-f5f4-3hh4-f54m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "tektoncd", "product": "pipelines-as-code", "versions": [{"status": "affected", "version": "< 0.37.8"}, {"status": "affected", "version": ">= 0.38.0, < 0.39.6"}, {"status": "affected", "version": ">= 0.40.0, < 0.42.1"}, {"status": "affected", "version": ">= 0.43.0, < 0.48.0"}]}], "references": [{"url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m", "name": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace", "name": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e", "name": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc", "name": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3", "name": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8", "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6", "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1", "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0", "name": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-15T14:29:45.535Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54167", "state": "PUBLISHED", "dateUpdated": "2026-09-15T14:49:57.706Z", "dateReserved": "2026-06-11T21:46:52.380Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-15T14:29:45.535Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pipelines-as-code", "vendor": "tektoncd", "versions": [{"status": "affected", "version": "< 0.37.8"}, {"status": "affected", "version": ">= 0.38.0, < 0.39.6"}, {"status": "affected", "version": ">= 0.40.0, < 0.42.1"}, {"status": "affected", "version": ">= 0.43.0, < 0.48.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0."}], "id": "CVE-2026-54167", "lastModified": "2026-09-30T17:43:24.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54167", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T14:49:51.787044Z", "version": "2.0.3"}}]}, "published": "2026-09-15T15:17:17.707", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header", "id": "2533858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533858"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-345", "details": ["Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.", "A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhook request, causing the system to send a locally signed GitHub App JSON Web Token (JWT) to an attacker-controlled service. This exposed JWT could then be used to attempt to generate installation access tokens, potentially leading to unauthorized access or actions within the GitHub App installation."], "mitigation": {"lang": "en:us", "value": "Until a patched release is deployed, block or strip unexpected X-GitHub-Enterprise-Host headers at the ingress or proxy in front of the Pipelines-as-Code webhook endpoint. For GitHub.com installations, reject requests containing this header; for GitHub Enterprise Server, permit only the expected hostname. Restrict webhook access to trusted Git provider sources where possible, and rotate the GitHub App private key if compromise is suspected."}, "name": "CVE-2026-54167", "package_state": [{"cpe": "cpe:/a:redhat:openshift_builds:1", "fix_state": "Not affected", "package_name": "openshift-builds/openshift-builds-rhel10-operator", "product_name": "Builds for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:openshift_builds:1", "fix_state": "Not affected", "package_name": "openshift-builds/openshift-builds-rhel9-operator", "product_name": "Builds for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines-client", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-cli-tkn-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-cli-tkn-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-opc-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-operator-proxy-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-operator-proxy-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-operator-webhook-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-operator-webhook-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-rhel8-operator", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-rhel9-operator", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/kn-client-kn-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/kn-plugin-func-func-util-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-clients", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/udi-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:webterminal:1", "fix_state": "Affected", "package_name": "web-terminal/web-terminal-tooling-rhel9", "product_name": "Red Hat Web Terminal"}], "public_date": "2026-09-15T14:29:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54167\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54167\nhttps://github.com/tektoncd/pipelines-as-code/commit/402d5c7eeece881cb082ec68e9e8b61709e39ace\nhttps://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e\nhttps://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc\nhttps://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1\nhttps://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0\nhttps://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"], "statement": "This flaw has an Important impact because vulnerable Pipelines-as-Code GitHub App webhook deployments can disclose a locally signed GitHub App JWT to an attacker-controlled host. An unauthenticated remote attacker who can reach the webhook endpoint can supply an untrusted Enterprise-host header; the exposed JWT may enable installation-token minting within its validity window and configured permissions.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.37.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.38.0,0.39.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.40.0,0.42.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.43.0,0.48.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pipelines-as-code", "source": "cna", "vendor": "tektoncd"}, "product": "pipelines-as-code", "vendor": "tektoncd"}], "created": "2026-09-16T05:30:13.455743+00:00", "updated": "2026-09-17T19:58:58.209526+00:00", "vendors": ["tektoncd", "tektoncd$PRODUCT$pipelines-as-code"]}