Insufficient Token Scoping in Pipelines-as-Code CI/CD System by Tekton
CVE-2026-54168
What is CVE-2026-54168?
A security vulnerability in the Pipelines-as-Code CI/CD system allows for improper token scoping during webhook processing. When installed across multiple repositories, a GitHub App may generate an installation token that lacks proper restrictions to the specific repository that triggered the event. As a consequence, users with push access to one repository can exploit this token to access private repository resources within the same installation. This results in potential exposure of sensitive Tekton definitions without providing write access. The vulnerability has been addressed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
Affected Version(s)
pipelines-as-code < 0.37.8 < 0.37.8
pipelines-as-code >= 0.38.0, < 0.39.6 < 0.38.0, 0.39.6
pipelines-as-code >= 0.40.0, < 0.42.1 < 0.40.0, 0.42.1