tocsin

CVE-2026-54167

2 advisories.

Go/github.com/openshift-pipelines/pipelines-as-code CVE-2026-54167: high 8.2, EPSS 0.27%

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Action: Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.

go get github.com/openshift-pipelines/pipelines-as-code@v0.48.0
go get github.com/openshift-pipelines/pipelines-as-code@v0.42.1
go get github.com/openshift-pipelines/pipelines-as-code@v0.39.6
go get github.com/openshift-pipelines/pipelines-as-code@v0.37.8

Affected

introducedfixedlast affected
0.43.00.48.0-
0.40.00.42.1-
0.38.00.39.6-
00.37.8-

Fixed versions

0.48.00.42.10.39.60.37.8

Sources

CVE-2026-54167 · published · modified · JSON

Go/github.com/openshift-pipelines/pipelines-as-code CVE-2026-54167: unknown, EPSS 0.27%

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code

Action: Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.

go get github.com/openshift-pipelines/pipelines-as-code@v0.37.8
go get github.com/openshift-pipelines/pipelines-as-code@v0.39.6
go get github.com/openshift-pipelines/pipelines-as-code@v0.42.1
go get github.com/openshift-pipelines/pipelines-as-code@v0.48.0

Affected

introducedfixedlast affected
00.37.8-
0.38.00.39.6-
0.40.00.42.1-
0.43.00.48.0-

Fixed versions

0.37.80.39.60.42.10.48.0

Sources

CVE-2026-54167 · published · modified · JSON