Tekton Pipelines-as-Code prior to versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0 contains an insufficient verification of data authenticity vulnerability (CWE-345) in its GitHub App webhook processing. Specifically, the GitHub App provider accepts the X-GitHub-Enterprise-Host header as the API host before validating the webhook signature or confirming that the host matches the repository URL in the signed payload. This flaw allows an unauthenticated attacker who can reach the webhook endpoint to specify an attacker-controlled host, causing the controller to send a locally signed GitHub App JWT to that host. The exposed JWT may be used to attempt minting installation access tokens within the JWT's validity window, subject to the GitHub App's installation and permissions. The installation-lookup path is also affected but requires a valid webhook secret for exploitation. The vulnerability is addressed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

An unauthenticated attacker able to reach the webhook endpoint can cause the system to send a signed GitHub App JWT to an attacker-controlled host. This JWT could be used to attempt minting installation access tokens, potentially allowing unauthorized access to GitHub App resources within the scope of the app's permissions. The impact includes potential unauthorized access to CI/CD pipeline operations or repository data. However, exploitation of the installation-lookup path requires a valid webhook secret, limiting attack vectors. There are no known exploits in the wild at this time.

This vulnerability is fixed in Tekton Pipelines-as-Code versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0. Users should upgrade to one of these versions or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.