Go/github.com/openshift-pipelines/pipelines-as-code CVE-2026-54167: high 8.2
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Action: Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.
go get github.com/openshift-pipelines/pipelines-as-code@v0.48.0go get github.com/openshift-pipelines/pipelines-as-code@v0.42.1go get github.com/openshift-pipelines/pipelines-as-code@v0.39.6go get github.com/openshift-pipelines/pipelines-as-code@v0.37.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.43.0 | 0.48.0 | - |
| 0.40.0 | 0.42.1 | - |
| 0.38.0 | 0.39.6 | - |
| 0 | 0.37.8 | - |
Fixed versions
| 0.48.0 | 0.42.1 | 0.39.6 | 0.37.8 |
Sources
- osv: GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m
- https://github.com/tektoncd/pipelines-as-code
CVE-2026-54167 · published · modified · JSON