---
id: CVE-2026-50240
title: >-
  Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code:
  repository users can trigger namespace edit-equivalent execution via
  auto-provisioned pipeline serviceaccount
summary: >-
  A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify
  whether the creator of a Repository custom resource has permission to create
  PipelineRuns. A namespace user with only Repository and Secret create/delete
  permissi…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: Red Hat
product: openshift-builds/openshift-builds-rhel9-operator
affected:
  - openshift-builds/openshift-builds-rhel9-operator (all versions)
  - openshift-pipelines-client (all versions)
  - openshift-pipelines/pipelines-cli-tkn-rhel8 (all versions)
  - openshift-pipelines/pipelines-cli-tkn-rhel9 (all versions)
  - openshift-pipelines/pipelines-opc-rhel9 (all versions)
  - openshift-pipelines/pipelines-operator-proxy-rhel8 (all versions)
  - openshift-pipelines/pipelines-operator-proxy-rhel9 (all versions)
  - openshift-pipelines/pipelines-operator-webhook-rhel8 (all versions)
  - openshift-pipelines/pipelines-operator-webhook-rhel9 (all versions)
  - openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 (all versions)
  - openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (all versions)
  - >-
    openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8 (all
    versions)
  - >-
    openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 (all
    versions)
  - openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8 (all versions)
  - openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9 (all versions)
  - openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8 (all versions)
  - openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9 (all versions)
  - openshift-pipelines/pipelines-rhel8-operator (all versions)
  - openshift-pipelines/pipelines-rhel9-operator (all versions)
  - openshift-serverless-1/kn-client-kn-rhel9 (all versions)
  - openshift-serverless-1/kn-plugin-func-func-util-rhel9 (all versions)
  - openshift-serverless-clients (all versions)
  - devspaces/udi-rhel9 (all versions)
  - web-terminal/web-terminal-tooling-rhel9 (all versions)
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T21:53:53.997Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-50240'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-50240'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2484752'
    label: RHBZ#2484752
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.298Z'
epss: 0.0037
epssPercentile: 0.31147
---

## Overview

A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.

## Affected

- `openshift-builds/openshift-builds-rhel9-operator (all versions)`
- `openshift-pipelines-client (all versions)`
- `openshift-pipelines/pipelines-cli-tkn-rhel8 (all versions)`
- `openshift-pipelines/pipelines-cli-tkn-rhel9 (all versions)`
- `openshift-pipelines/pipelines-opc-rhel9 (all versions)`
- `openshift-pipelines/pipelines-operator-proxy-rhel8 (all versions)`
- `openshift-pipelines/pipelines-operator-proxy-rhel9 (all versions)`
- `openshift-pipelines/pipelines-operator-webhook-rhel8 (all versions)`
- `openshift-pipelines/pipelines-operator-webhook-rhel9 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8 (all versions)`
- `openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9 (all versions)`
- `openshift-pipelines/pipelines-rhel8-operator (all versions)`
- `openshift-pipelines/pipelines-rhel9-operator (all versions)`
- `openshift-serverless-1/kn-client-kn-rhel9 (all versions)`
- `openshift-serverless-1/kn-plugin-func-func-util-rhel9 (all versions)`
- `openshift-serverless-clients (all versions)`
- `devspaces/udi-rhel9 (all versions)`
- `web-terminal/web-terminal-tooling-rhel9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Set legacyPipelineRbac to false in the TektonConfig custom resource. This prevents the OpenShift Pipelines operator from auto-provisioning the openshift-pipelines-edit RoleBinding that grants the pipeline ServiceAccount ClusterRole/edit in every namespace. Warning: this may break existing pipelines that rely on the pipeline ServiceAccount having edit permissions. Simply deleting the openshift-pipelines-edit RoleBinding is NOT sufficient — the operator reconciliation loop will re-create it unless legacyPipelineRbac is set to false.