CVE-2026-127075 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree BuildPiper before 2.7.0 lets an authenticated user supply traversal sequences in Additional Manifest file paths, so the renderer reads files outside the intended directory. The file contents are embedded in generated manifests and logs, exposing configuration files and service-account tokens.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run OpsTree BuildPiper below 2.7.0 where users can enter Additional Manifest file paths. The flaw requires a logged-in account, so exposure depends on who holds accounts on the instance. Instances without BuildPiper, or already on 2.7.0 or later, are not affected.
Not affected if already-on-2.7.0, no-buildpiper
Who cares buildpiper, ci-cd, kubernetes
2.7.0 are in the affected range.2.7.0 or later.OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.