CVE-2026-127080 · Other
NO FIX YET · SEE WHAT TO DO
BuildPiper before 2.7.0 lets authenticated deploy users define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. An attacker can mount the worker node's root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
BuildPiper installations before 2.7.0 where users with deploy permission can configure Kubernetes workloads. Deployments that are not BuildPiper, or that run only trusted deployers, are less exposed; the sources do not say more.
Not affected if buildpiper-2.7.0-or-later
Who cares buildpiper, ci-cd, kubernetes
2.7.0.2.7.0 or later.OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.