Go/github.com/openshift-pipelines/pipelines-as-code CVE-2026-54168: medium 6.5, EPSS 0.59%
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Action: Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.
go get github.com/openshift-pipelines/pipelines-as-code@v0.37.8go get github.com/openshift-pipelines/pipelines-as-code@v0.39.6go get github.com/openshift-pipelines/pipelines-as-code@v0.42.1go get github.com/openshift-pipelines/pipelines-as-code@v0.48.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.37.8 | - |
| 0.38.0 | 0.39.6 | - |
| 0.40.0 | 0.42.1 | - |
| 0.43.0 | 0.48.0 | - |
Fixed versions
| 0.37.8 | 0.39.6 | 0.42.1 | 0.48.0 |
Sources
- osv: GHSA-6f2p-296r-cc28
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28
- https://github.com/tektoncd/pipelines-as-code
CVE-2026-54168 · published · modified · JSON