Cpe:2.3:a:redhat:openshift_pipelines-as-Code:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aredhatopenshift_pipelines-as-code/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 23:27:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRed Hat OpenShift Pipelines-as-Code: Privilege escalation (CVE-2026-50240)https://feed.craftedsignal.io/briefs/2026-11-openshift-pac-privesc/Fri, 06 Nov 2026 23:27:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openshift-pac-privesc/A privilege escalation vulnerability in Red Hat OpenShift Pipelines-as-Code (PAC) allows low-privileged users to execute unauthorized PipelineRuns with elevated permissions via the Repository custom resource.A vulnerability exists in OpenShift Pipelines-as-Code (PAC) where the platform fails to verify if a user creating a Repository custom resource has the required permissions to trigger PipelineRuns. An attacker with minimal Repository and Secret create/delete permissions can force PAC to execute arbitrary PipelineRuns using the auto-provisioned ServiceAccount. This ServiceAccount carries the ClusterRole/edit permission by default, leading to privilege escalation within the CI/CD namespace.

Impact

Successful exploitation allows for unauthorized read access to Secrets, modification or deletion of namespace resources, and potential supply chain injection by executing malicious pipeline logic under a high-privilege ServiceAccount.

Recommendation

  • Inventory all namespaces where OpenShift Pipelines-as-Code is deployed and in use.
  • Apply the vendor-provided patch for OpenShift Pipelines-as-Code to address the missing authorization check.
  • Review RBAC policies for users with Repository and Secret creation permissions to ensure they are restricted from creating these resources in sensitive CI/CD namespaces until the patch is applied.
]]>highadvisory