Red Hat OpenShift Pipelines-as-Code: Privilege escalation (CVE-2026-50240)

A vulnerability exists in OpenShift Pipelines-as-Code (PAC) where the platform fails to verify if a user creating a Repository custom resource has the required permissions to trigger PipelineRuns. An attacker with minimal Repository and Secret create/delete permissions can force PAC to execute arbitrary PipelineRuns using the auto-provisioned ServiceAccount. This ServiceAccount carries the ClusterRole/edit permission by default, leading to privilege escalation within the CI/CD namespace.

Impact

Successful exploitation allows for unauthorized read access to Secrets, modification or deletion of namespace resources, and potential supply chain injection by executing malicious pipeline logic under a high-privilege ServiceAccount.

Recommendation

• Inventory all namespaces where OpenShift Pipelines-as-Code is deployed and in use.
• Apply the vendor-provided patch for OpenShift Pipelines-as-Code to address the missing authorization check.
• Review RBAC policies for users with Repository and Secret creation permissions to ensure they are restricted from creating these resources in sensitive CI/CD namespaces until the patch is applied.