{"action":"Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.","affected":[{"fixed":"0.37.8","introduced":"0"},{"fixed":"0.39.6","introduced":"0.38.0"},{"fixed":"0.42.1","introduced":"0.40.0"},{"fixed":"0.48.0","introduced":"0.43.0"}],"component":"github.com/openshift-pipelines/pipelines-as-code","cve_ids":["CVE-2026-54168"],"ecosystem":"Go","epss":0.00587,"exploited":false,"fixed_versions":["0.37.8","0.39.6","0.42.1","0.48.0"],"ghsa_id":"GHSA-6f2p-296r-cc28","id":"tcs_01M5KGSRFA79XFP401KHRW5TP7","modified_at":"2026-08-26T01:21:30.248528398Z","published_at":"2026-08-25T19:43:10Z","references":["https://osv.dev/vulnerability/GO-2026-6263","https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6263","url":"https://osv.dev/vulnerability/GO-2026-6263"}],"summary":"Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code"}