{"action":"Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.","affected":[{"fixed":"0.48.0","introduced":"0.43.0"},{"fixed":"0.42.1","introduced":"0.40.0"},{"fixed":"0.39.6","introduced":"0.38.0"},{"fixed":"0.37.8","introduced":"0"}],"component":"github.com/openshift-pipelines/pipelines-as-code","cve_ids":["CVE-2026-54167"],"ecosystem":"Go","epss":0.00268,"exploited":false,"fixed_versions":["0.48.0","0.42.1","0.39.6","0.37.8"],"ghsa_id":"GHSA-f5f4-3hh4-f54m","id":"tcs_01M5KF8D207S9BJPCMSZVEF06V","modified_at":"2026-08-26T01:21:46.548790533Z","published_at":"2026-08-20T18:36:30Z","references":["https://osv.dev/vulnerability/GHSA-f5f4-3hh4-f54m","https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m","https://github.com/tektoncd/pipelines-as-code"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-f5f4-3hh4-f54m","url":"https://osv.dev/vulnerability/GHSA-f5f4-3hh4-f54m"}],"summary":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header"}