Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-54168
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 21:16 UTC · Revision 1
Source evidence
Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
core-osv · Original sourcePublished 15 Sept 2026, 14:27 UTC
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
osv:CVE-2026-54168
Complete source record
{
"id": "33e70f14aa2eea375409b043b75635c172f941b7e78fb87cf1806cfc1f62e156",
"url": "https://osv.dev/vulnerability/CVE-2026-54168",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution",
"summary": "Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installed across multiple repositories. A user with push access to one repository can submit a PipelineRun containing a pipelinesascode.tekton.dev/task remote task annotation that targets a private repository in the same installation. When ScopeTokenToListOfRepos returns no explicit scope, the missing triggering repository ID leaves the token able to access the entire installation. Pipelines-as-Code resolves and inlines the remote private task with that token, disclosing the repository's Tekton definitions. The demonstrated impact is read-only and does not provide write access. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.",
"evidence": "osv:CVE-2026-54168",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-54168",
"aliases": [
"CVE-2026-54168",
"GHSA-6f2p-296r-cc28",
"GO-2026-6263"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tektoncd/pipelines-as-code",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "bdd53809c46428a60974c1b327e4d381d972e554"
},
{
"introduced": "43a6811e19718fdab05280e188fe97be4d727565"
},
{
"fixed": "af48fc833cddd3f4dc8fe315cfa3cf17148e1668"
},
{
"introduced": "9d60ff70fe50becee02ec2ead487bdfb1bd525e6"
},
{
"fixed": "d4044f270cd09555ff745937fa0f5dcc1d7cd1da"
},
{
"introduced": "eff5928d5b1c3a816e2b0f61f2e53a1af6109161"
},
{
"fixed": "402d5c7eeece881cb082ec68e9e8b61709e39ace"
},
{
"fixed": "001782829e82b83ecb3da903f5a024ca0826b64c"
},
{
"fixed": "40813976a77920feaf52671320d6d3c5ff08eb7e"
},
{
"fixed": "ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
},
{
"fixed": "e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.37.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0.38.0"
},
{
"fixed": "0.39.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0.40.0"
},
{
"fixed": "0.42.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0.43.0"
},
{
"fixed": "0.48.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "001782829e82b83ecb3da903f5a024ca0826b64c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "40813976a77920feaf52671320d6d3c5ff08eb7e"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "bdd53809c46428a60974c1b327e4d381d972e554"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.37.8"
},
{
"range": [
{
"fixed": "af48fc833cddd3f4dc8fe315cfa3cf17148e1668"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.39.6"
},
{
"range": [
{
"fixed": "d4044f270cd09555ff745937fa0f5dcc1d7cd1da"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.42.1"
},
{
"range": [
{
"fixed": "402d5c7eeece881cb082ec68e9e8b61709e39ace"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.48.0"
}
]
}
}
],
"versions": [
"v0.47.0",
"v0.46.0",
"v0.45.0",
"v0.44.0",
"v0.43.0",
"v0.42.0",
"v0.37.7",
"v0.39.5",
"v0.37.6",
"v0.41.1",
"v0.37.5",
"v0.39.4",
"v0.41.0",
"v0.40.0",
"v0.39.3",
"v0.37.4",
"v0.39.2",
"v0.39.1",
"v0.37.3",
"v0.37.2",
"v0.39.0",
"v0.37.1",
"v0.37.0",
"v0.38.0",
"v0.36.0",
"v0.35.0",
"v0.34.0",
"v0.33.0",
"v0.32.0",
"v0.31.0",
"v0.30.0",
"v0.29.0",
"v0.28.0",
"v0.27.2",
"v0.27.1",
"v0.27.0",
"v0.26.0",
"v0.25.0",
"v0.24.0",
"v0.23.0",
"v0.22.5",
"v0.22.1",
"v0.22.0",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.20.0",
"v0.19.0",
"v0.18.0",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.3",
"v0.15.2",
"v0.15.1",
"v0.15.0",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.13.1",
"v0.13.0",
"v0.11.0",
"0.10.0",
"0.9.0",
"0.8.0",
"0.7.1",
"0.6.1",
"0.6.0",
"0.5.3",
"0.5.2",
"0.5.1",
"0.5.0",
"0.4.2",
"0.4.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54168.json"
}
}
],
"modified": "2026-10-28T02:30:39.822587963Z",
"provider": "osv",
"references": [
"https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.37.8",
"https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.39.6",
"https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.42.1",
"https://github.com/tektoncd/pipelines-as-code/releases/tag/v0.48.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54168.json",
"https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28",
"https://nvd.nist.gov/vuln/detail/CVE-2026-54168",
"https://github.com/tektoncd/pipelines-as-code/commit/001782829e82b83ecb3da903f5a024ca0826b64c",
"https://github.com/tektoncd/pipelines-as-code/commit/40813976a77920feaf52671320d6d3c5ff08eb7e",
"https://github.com/tektoncd/pipelines-as-code/commit/ac6fded6dfb69ade7197d4eeed6e90ddbe1b79bc",
"https://github.com/tektoncd/pipelines-as-code/commit/e0c4a11ea3800ab9d26cf3a8ae92b74cf18527c3"
],
"provider_metadata": {
"cwe_ids": [
"CWE-269",
"CWE-862"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54168.json"
}
},
"related_cves": [
{
"value": "CVE-2026-54168",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 507150,
"published_at": "2026-09-15T14:27:44.344+00:00"
}