BUILDPIPER · CVE-2026-127078 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree BuildPiper before 2.7.0 lets a logged-in user attach another application's environment to their own service by supplying a foreign project_env_id. An attacker can then trigger builds and deployments using the other application's registries and deployment infrastructure.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running a self-hosted OpsTree BuildPiper instance where more than one application or team shares the platform. Any authenticated user can reach the component env endpoints, so a single-tenant deployment with only trusted users is less exposed. The sources do not say which configurations are default.
Not affected if single-tenant-deployment, version-2.7.0-or-later
Who cares buildpiper, ci-cd, self-hosted
2.7.02.7.0 (fixed version per NVD description)OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.