{"action":"Upgrade github.com/openshift-pipelines/pipelines-as-code to 0.37.8 or later.","affected":[{"fixed":"0.37.8","introduced":"0"},{"fixed":"0.39.6","introduced":"0.38.0"},{"fixed":"0.42.1","introduced":"0.40.0"},{"fixed":"0.48.0","introduced":"0.43.0"}],"component":"github.com/openshift-pipelines/pipelines-as-code","cve_ids":["CVE-2026-54167"],"ecosystem":"Go","epss":0.00268,"exploited":false,"fixed_versions":["0.37.8","0.39.6","0.42.1","0.48.0"],"ghsa_id":"GHSA-f5f4-3hh4-f54m","id":"tcs_01M5KGSRZ94TKZVNZZ24NX7TWH","modified_at":"2026-08-26T01:21:40.536313331Z","published_at":"2026-08-25T19:43:10Z","references":["https://osv.dev/vulnerability/GO-2026-6266","https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-f5f4-3hh4-f54m"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GO-2026-6266","url":"https://osv.dev/vulnerability/GO-2026-6266"},{"source":"nvd","source_id":"CVE-2026-54167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54167"}],"summary":"Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code"}