Skip to content
Threat Feed
Subscribe

Product

Pipelines-as-Code

1 brief RSS
high advisory

Pipelines-as-Code GitHub App Credential Exfiltration via Header Injection

Pipelines-as-Code (CVE-2026-54167) is vulnerable to GitHub App JWT exfiltration because it incorrectly trusts the 'X-GitHub-Enterprise-Host' header to define the API endpoint before validating incoming webhook signatures.

Pipelines-as-Code cve-2026-54167 credential-theft red-hat webserver
2t