CVE-2026-127074 · Vendor
NO FIX YET · SEE WHAT TO DO
OpsTree BuildPiper before 2.7.0 does not validate the dockerfile_path and build context values, so a user can point a build at paths like /etc/passwd. Triggering the build then writes the file contents into the build log, which the attacker can read.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running OpsTree BuildPiper before 2.7.0 where users have build configuration permission. Exposure depends on whether those users can set the dockerfile_path and build context values and read build logs. Instances already on 2.7.0 or later are not affected by this flaw.
Not affected if no-build-config-permission-users, version-2.7.0-or-later
Who cares buildpiper, ci-cd, self-hosted
2.7.0 or later (per the advisory's affected range)OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.