CVE-2026-127073 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree BuildPiper before 2.7.0 lets project users submit unrestricted manifests through its Additional Manifest feature. An attacker can deploy a ClusterRoleBinding granting cluster-admin, which the pipeline applies with cluster-wide credentials, giving control of all workloads and secrets.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
BuildPiper installations before 2.7.0 that use the Additional Manifest feature and apply pipeline manifests to a Kubernetes cluster with cluster-wide credentials. Teams not running BuildPiper, or running it at 2.7.0 or later, are not affected by this description. Sources do not state other preconditions.
Not affected if version-2.7.0-or-later
Who cares buildpiper, ci-cd, kubernetes
2.7.0.2.7.0 or later.OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.