CVE-2026-127081 · Other
NO FIX YET · SEE WHAT TO DO
OpsTree BuildPiper before 2.7.0 lets a logged-in user attach pipeline stages to environments belonging to other projects by sending a foreign project_env_id to the stages endpoint. The cross-project links persist and break the separation between projects.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted BuildPiper instance with more than one project and let users other than administrators create pipeline stages. Single-project deployments or instances where only trusted staff have accounts are less exposed.
Not affected if single-project, trusted-users-only
Who cares buildpiper, ci-cd, self-hosted
2.7.0 or later.OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.