A vulnerability in OpenShift Pipelines-as-Code (PAC) allows a namespace user with limited permissions to escalate privileges within that namespace. The flaw arises because PAC does not verify if the creator of a Repository custom resource is authorized to create PipelineRuns. This enables execution of attacker-controlled PipelineRuns with the pipeline ServiceAccount, which by default has ClusterRole/edit permissions. The result is namespace-scoped privilege escalation, allowing unauthorized reading of Secrets, resource manipulation, and potential supply chain injection in CI/CD namespaces.