Threats tagged 'ghsa-j8x6-g54c-3wg2'

OpsTree BuildPiper versions before 2.7.0 have a critical privilege escalation vulnerability. Project users can exploit the Additional Manifest feature to submit unrestricted Kubernetes manifests. This allows attackers to create a ClusterRoleBinding that grants cluster-admin rights to a service account. The pipeline applies these manifests with cluster-wide credentials, enabling full control over all workloads and secrets in the Kubernetes cluster.