Description

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-15T15:17:17.887Z",
  "pubdate": "2026-09-15T15:17:17.887Z",
  "executiveSummary": "Pipelines-as-Code is susceptible to an authorization bypass vulnerability occurring during the processing of GitHub App installation tokens.\nThe vulnerability originates from improperly scoped authentication tokens when the GitHub App is installed across multiple repositories, failing to restrict token access to the specific repository that triggered the event.\nAn attacker with push access to one repository within the installation can leverage this flaw to access and disclose Tekton definitions from other private repositories managed by the same GitHub App.\nThe impact is limited to unauthorized read-only access to remote task configurations; there is no documented escalation to write access.\nThis issue affects Pipelines-as-Code versions prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0.\nExploitation requires the attacker to have legitimate push access to at least one repository within the target installation and the ability to submit a PipelineRun containing a pipelinesascode.tekton.dev/task annotation.",
  "technicalDetails": "The vulnerability exists within the logic responsible for generating and scoping GitHub App installation tokens during webhook event processing. In scenarios where the GitHub App is configured with broad permissions across multiple repositories, the authentication mechanism fails to enforce repository-level isolation.\nThe root cause is identified as an insufficient implementation of the ScopeTokenToListOfRepos function. When this function returns no explicit repository scope, the system defaults to providing a token with broad access across the entire GitHub App installation, rather than restricting the token to the specific repository context of the triggering event.\nAn attacker exploits this by crafting a malicious PipelineRun. By utilizing the pipelinesascode.tekton.dev/task annotation, the attacker points the pipeline to a remote task residing in a different, private repository within the same GitHub App installation. When the controller processes this request, it utilizes the over-privileged installation token to resolve and inline the remote task.\nBecause the token is not restricted to the repository of origin, the GitHub API accepts the request for the private task content. The Pipelines-as-Code controller subsequently fetches the Tekton definitions from the secondary repository and includes them in the current pipeline's execution context. This mechanism results in the inadvertent disclosure of potentially sensitive CI/CD configurations or secrets contained within Tekton definitions from other repositories.\nThe attack flow proceeds as follows: 1) The attacker initiates a commit or webhook event in a repository where they possess push access. 2) The attacker submits a PipelineRun definition containing a targeted remote task annotation pointing to a sensitive file in a different repository. 3) The Pipelines-as-Code controller authenticates using the overly permissive installation token. 4) The controller retrieves the private remote task file, bypassing the intended authorization boundaries. 5) The sensitive task definitions are rendered and disclosed within the attacker-controlled PipelineRun.\nThe vulnerability affects all versions of Pipelines-as-Code prior to the 0.37.8, 0.39.6, 0.42.1, and 0.48.0 release branches. Post-exploitation impact is restricted to unauthorized read access; the system does not appear to provide pathways for modifying or writing to those private repositories, as the primary risk is limited to data exfiltration of Pipeline configuration metadata."
}