---
id: CVE-2026-54168
title: >-
  Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in
  source code repositories
summary: >-
  Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in
  source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a
  GitHub App installation token created during webhook processing is not scoped
  to the …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-269
  - CWE-862
vendor: tektoncd
product: pipelines-as-code
affected:
  - pipelines-as-code < 0.37.8
  - 'pipelines-as-code >= 0.38.0, < 0.39.6'
  - 'pipelines-as-code >= 0.40.0, < 0.42.1'
  - 'pipelines-as-code >= 0.43.0, < 0.48.0'
patched:
  - github.com/openshift-pipelines/pipelines-as-code 0.37.8
  - github.com/openshift-pipelines/pipelines-as-code 0.39.6
  - github.com/openshift-pipelines/pipelines-as-code 0.42.1
  - github.com/openshift-pipelines/pipelines-as-code 0.48.0
published: '2026-09-15'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T15:16:47.743'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54168'
references:
  - url: >-
      https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c
    label: security-advisories@github.com
  - url: >-
      https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e
    label: security-advisories@github.com
  - url: >-
      https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc
    label: security-advisories@github.com
  - url: >-
      https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3
    label: security-advisories@github.com
  - url: 'https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8'
    label: security-advisories@github.com
  - url: 'https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6'
    label: security-advisories@github.com
  - url: 'https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1'
    label: security-advisories@github.com
  - url: 'https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28
    label: security-advisories@github.com
  - url: 'https://github.com/tektoncd/pipelines-as-code'
  - url: 'https://github.com/advisories/GHSA-6f2p-296r-cc28'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54168.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-54168'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2533851'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-54168'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54168'
tags:
  - nvd
  - cve.org
  - osv
  - go
  - ghsa
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T14:30:42.954463Z'
epss: 0.00587
epssPercentile: 0.45773
aliases:
  - GHSA-6f2p-296r-cc28
  - GO-2026-6263
ecosystem: go
ingestedAt: '2026-08-20T18:59:55.010Z'
---

## Overview

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54168)

Affected packages:

- `github.com/openshift-pipelines/pipelines-as-code < 0.37.8`
- `github.com/openshift-pipelines/pipelines-as-code >= 0.38.0, < 0.39.6`
- `github.com/openshift-pipelines/pipelines-as-code >= 0.40.0, < 0.42.1`
- `github.com/openshift-pipelines/pipelines-as-code >= 0.43.0, < 0.48.0`

Patched in:

- `github.com/openshift-pipelines/pipelines-as-code 0.37.8`
- `github.com/openshift-pipelines/pipelines-as-code 0.39.6`
- `github.com/openshift-pipelines/pipelines-as-code 0.42.1`
- `github.com/openshift-pipelines/pipelines-as-code 0.48.0`

Source: https://osv.dev/vulnerability/GHSA-6f2p-296r-cc28

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54168.json)