Privilege Escalation Vulnerability in OpenShift Pipelines-as-Code from Red Hat
CVE-2026-50240

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Builds For Red Hat Openshift
Openshift Pipelines
Openshift Serverless
Red Hat Openshift Dev Spaces
Vendor
CVE Published:
6 November 2026

What is CVE-2026-50240?

A vulnerability exists in OpenShift Pipelines-as-Code (PAC) where the system fails to validate whether the creator of a Repository custom resource has the required permissions to create PipelineRuns. As a result, a user with limited permissions, specifically those allowing them to create and delete Repositories and Secrets, may exploit this to execute PipelineRuns controlled by an attacker. These runs will execute under the auto-provisioned pipeline ServiceAccount, which, by default, has expansive ClusterRole/edit permissions. This flaw creates a pathway for namespace-scoped privilege escalation, allowing unauthorized access to read Secrets, and to create, modify, or delete resources. Additionally, there is a risk of supply chain injection attacks within CI/CD environments, posing significant threats to the integrity of the software development lifecycle.

References

https://access.redhat.com/security/cve/CVE-2026-50240
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2484752
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue.
.