CVE-2026-127076 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree BuildPiper before 2.7.0 has a broken access control flaw that lets any logged-in user list Git repositories belonging to other projects. An attacker can then trigger builds from those repositories and read their source code, manifests and committed secrets.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted BuildPiper instance with more than one project and more than one user account. A single-project setup where every user may see every repository has less exposure, but the flaw still lets any authenticated user reach repositories they should not. Instances on 2.7.0 or later are not affected.
Not affected if single-user-instance, version-2.7.0-or-later
Who cares buildpiper, ci, self-hosted
2.7.0 are affected.GET /api/v1/git_repo/?all=true.2.7.0 or later, per the advisory description.OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.