CVE-2026-50240High· 8.8▾ TwilightA flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.
openshift-builds/openshift-builds-rhel9-operator (all versions)openshift-pipelines-client (all versions)openshift-pipelines/pipelines-cli-tkn-rhel8 (all versions)openshift-pipelines/pipelines-cli-tkn-rhel9 (all versions)openshift-pipelines/pipelines-opc-rhel9 (all versions)openshift-pipelines/pipelines-operator-proxy-rhel8 (all versions)openshift-pipelines/pipelines-operator-proxy-rhel9 (all versions)openshift-pipelines/pipelines-operator-webhook-rhel8 (all versions)openshift-pipelines/pipelines-operator-webhook-rhel9 (all versions)openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 (all versions)openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (all versions)openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8 (all versions)openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 (all versions)openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8 (all versions)openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9 (all versions)openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8 (all versions)openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9 (all versions)openshift-pipelines/pipelines-rhel8-operator (all versions)openshift-pipelines/pipelines-rhel9-operator (all versions)openshift-serverless-1/kn-client-kn-rhel9 (all versions)openshift-serverless-1/kn-plugin-func-func-util-rhel9 (all versions)openshift-serverless-clients (all versions)devspaces/udi-rhel9 (all versions)web-terminal/web-terminal-tooling-rhel9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Set legacyPipelineRbac to false in the TektonConfig custom resource. This prevents the OpenShift Pipelines operator from auto-provisioning the openshift-pipelines-edit RoleBinding that grants the pipeline ServiceAccount ClusterRole/edit in every namespace. Warning: this may break existing pipelines that rely on the pipeline ServiceAccount having edit permissions. Simply deleting the openshift-pipelines-edit RoleBinding is NOT sufficient — the operator reconciliation loop will re-create it unless legacyPipelineRbac is set to false.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109081Medium· 6.8Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint
CVE-2026-92856Medium· 4.9Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints
CVE-2026-96547Medium· 6.5Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
CVE-2026-114232High· 8.1Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
CVE-2026-111253Medium· 6.6Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
CVE-2026-107912High· 7.7Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw