Skip to content
Fencer Intel
high 8.8

CVE-2026-50240 json

Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount

published 20d ago modified yesterday also EUVD-2026-118524 , GHSA-8m5v-wh4r-5j96

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository tektoncd/pipelines-as-code. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.

Patch / fix

  • tektoncd pipelines-as-code 0.42.4, 0.48.2, 0.50.1

Is CVE-2026-50240 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-50240 updated cvss 8.8

pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: Repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline ServiceAccount

  • Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-rhel9-operator
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel8-operator, openshift-pipelines/pipelines-rhel9-operator, +8 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat OpenShift Dev Spaces devspaces/udi-rhel9 Red Hat Web Terminal web-terminal/web-terminal-tooling-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8, openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8, openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8, openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2d ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • tektoncd pipelines-as-code
  • Red Hat Builds for Red Hat OpenShift
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Web Terminal

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of tektoncd/pipelines-as-code published their own advisory on GitHub. Reviewed sources take precedence over it.