Threats tagged 'ghsa-xm2v-p36m-5c9q'

OpsTree BuildPiper versions before 2.7.0 have an authorization bypass vulnerability that allows authenticated users to create environments on Kubernetes clusters not assigned to their projects. By tampering with cluster_id and namespace values in requests, attackers can target other projects' clusters and trigger builds and deployments, bypassing project isolation.