CVE-2026-50240 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenShift Pipelines-as-Code does not check whether the creator of a Repository resource may create PipelineRuns. A namespace user with only Repository and Secret create or delete rights can make it run attacker-chosen PipelineRuns as the pipeline ServiceAccount, which has edit rights by default.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Red Hat OpenShift Pipelines with Pipelines-as-Code where some namespace users can create Repository resources and Secrets but are not meant to run pipelines. They can make PAC run their PipelineRuns as the pipeline ServiceAccount, which holds ClusterRole/edit by default, to read Secrets and change or inject into CI/CD resources in that namespace. Clusters without Pipelines-as-Code, or where only trusted users hold Repository create rights, can skip it. Red Hat lists no affected version range on its page, so treat installed versions as potentially affected until Red Hat says otherwise.
Not affected if no-namespace-repository-rights, no-pipelines-as-code
Who cares ci-cd, kubernetes, openshift, pipelines-as-code, tekton
oc get tektonconfig config -o yaml and look at legacyPipelineRbac (anything but false means the operator provisions the edit RoleBinding). oc get rolebinding openshift-pipelines-edit -n <ns> shows the edit binding for the pipeline ServiceAccountoc auth can-i create repositories.pipelinesascode.tekton.dev -n <ns> --as <user>A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.