{"action":"Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.","affected":[{"fixed":"0.37.8","introduced":"0"},{"fixed":"0.39.6","introduced":"0.38.0"},{"fixed":"0.42.1","introduced":"0.40.0"},{"fixed":"0.48.0","introduced":"0.43.0"}],"component":"github.com/openshift-pipelines/pipelines-as-code","cve_ids":["CVE-2026-54168"],"ecosystem":"Go","epss":0.00587,"exploited":false,"fixed_versions":["0.37.8","0.39.6","0.42.1","0.48.0"],"ghsa_id":"GHSA-6f2p-296r-cc28","id":"tcs_01M5KF00ZJBDFKQ5Y1ZDFQ52R5","modified_at":"2026-09-10T03:51:13.112551358Z","published_at":"2026-08-20T18:36:40Z","references":["https://osv.dev/vulnerability/GHSA-6f2p-296r-cc28","https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28","https://github.com/tektoncd/pipelines-as-code"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-6f2p-296r-cc28","url":"https://osv.dev/vulnerability/GHSA-6f2p-296r-cc28"}],"summary":"Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution"}