8.8High
CVE-2026-50240Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount
Description
A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.
Weakness (CWE):
CWE-862
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Red Hat | Builds for Red Hat OpenShift | all versions | |
| Red Hat | OpenShift Pipelines | all versions | |
| Red Hat | OpenShift Serverless | all versions | |
| Red Hat | Red Hat OpenShift Dev Spaces | all versions | |
| Red Hat | Red Hat Web Terminal | all versions | |
| — | pipelines-as-code | < 0.42.4, 0.43.0 – < 0.48.2, 0.49.0 – < 0.50.1 |