XSS Vulnerability in Tekton Pipelines-as-Code GitHub Integration
CVE-2026-54167
What is CVE-2026-54167?
This vulnerability in Tekton Pipelines-as-Code arises from its GitHub App provider, which permits the use of X-GitHub-Enterprise-Host as the API host without proper validation of the webhook signature or the corresponding repository URL. An unauthenticated attacker capable of accessing the webhook endpoint could exploit this flaw to have the controller send a locally signed GitHub App JSON Web Token (JWT) to an attacker-controlled service. This exposed JWT might be misused to attempt to generate installation access tokens while still valid, subject to the permissions and configurations of the GitHub App installation. This issue has been rectified in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Affected Version(s)
pipelines-as-code < 0.37.8 < 0.37.8
pipelines-as-code >= 0.38.0, < 0.39.6 < 0.38.0, 0.39.6
pipelines-as-code >= 0.40.0, < 0.42.1 < 0.40.0, 0.42.1