GHSA-fr9x-v7ch-736mHighCVSS 7.1
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-127078
- https://gist.github.com/neelkotnis/26f637bfda3513ab255d8f8e46bcf8d1
- https://www.buildpiper.io
- https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-project-env-id-parameter
- https://github.com/advisories/GHSA-fr9x-v7ch-736m