Threats affecting pkg:github/opstree/buildpiper

CVE-2026-127075 is a path traversal vulnerability in OpsTree BuildPiper versions before 2.7.0. Authenticated users can exploit this flaw by supplying directory traversal sequences in Additional Manifest file paths, enabling them to read arbitrary files such as configuration files and service-account tokens. The vulnerability allows embedding of sensitive file contents into generated manifests and logs. The issue is fixed in version 2.7.0.

OpsTree BuildPiper versions prior to 2.7.0 have a broken access control vulnerability that allows authenticated users to access Git repositories from other projects. This flaw enables attackers to list all repositories and build from repositories they should not have access to, potentially exposing source code, manifests, and committed secrets.

OpsTree BuildPiper versions prior to 2.7.0 have an authorization bypass vulnerability that allows authenticated users to create environments on Kubernetes clusters not assigned to their projects. By tampering with cluster_id and namespaces parameters in API requests, attackers can bypass project isolation and trigger builds and deployments on clusters belonging to other projects. This vulnerability is fixed in version 2.7.0.

OpsTree BuildPiper versions before 2.7.0 have an authorization bypass vulnerability that allows authenticated users to misuse another application's environment by supplying a foreign project_env_id. This enables attackers to configure continuous integration (CI) and trigger builds and deployments using the other application's settings and infrastructure.

CVE-2026-127079 is a critical vulnerability in OpsTree Solutions BuildPiper versions before 2.7.0. The product lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTP codes. This enables attackers to reset user passwords and take over accounts. The issue is fixed in version 2.7.0.

CVE-2026-127080 is a critical improper authorization vulnerability in OpsTree Solutions BuildPiper versions prior to 2.7.0. Authenticated deploy users can define arbitrary Kubernetes hostPath volumes without allow-list or policy checks, including setting the host path to the root directory (/). This allows mounting the worker node's root filesystem with read-write access, breaking container isolation and enabling potential node and cluster compromise. The issue is fixed in BuildPiper version 2.7.0.

OpsTree BuildPiper versions before 2.7.0 have an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by submitting a foreign project environment identifier. This bypasses project separation controls and can lead to unauthorized cross-project associations.