GHSA-xm2v-p36m-5c9qHighCVSS 7.1
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-127077
- https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574
- https://www.buildpiper.io
- https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-environment-creation-api
- https://github.com/advisories/GHSA-xm2v-p36m-5c9q