CVE-2026-50240

CVSS 8.8 (high) · published 2026-11-06

A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.

Weakness: CWE-862

Source: NVD CVE-2026-50240

References

• https://access.redhat.com/security/cve/CVE-2026-50240
• https://bugzilla.redhat.com/show_bug.cgi?id=2484752
• https://github.com/openshift-pipelines/pipelines-as-code/commit/ac1ff2337fce1ffdf888f513c6202caa95853927
• https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-8m5v-wh4r-5j96

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.