What happened
An identified vulnerability in OpenShift Pipelines-as-Code (PAC) has been disclosed, designated as CVE-2026-50240. The flaw allows exploitation due to PAC's failure to verify whether the creator of a Repository custom resource possesses permission for creating PipelineRuns. An attacker with access to a namespace who has only Repository and Secret create/delete permissions can manipulate PAC to run attacker-controlled PipelineRuns using the auto-provisioned pipeline ServiceAccount. This account by default holds ClusterRole/edit privileges. Exploitation can lead to a form of privilege escalation within the namespace, enabling the attacker to read secrets, and create, modify, or delete resources. Such actions may facilitate supply chain injections in CI/CD pipelines. The vulnerability can be exploited remotely over a network without requiring user interaction or elevated privileges from the attacker. It arises from an exposed service that can be targeted directly, making network exposure, segmentation, and access controls critical mitigations. The flaw poses a high severity risk with an CVSS score of 8.8, indicating significant impact if exploited. The vulnerable components include Red Hat Builds for Red Hat OpenShift, Red Hat OpenShift Pipelines, and several other Red Hat products related to container orchestration and development environments. Patch status for the vulnerability has not been specified; affected organisations are advised to consult vendor advisories for details about fixed versions. The report was issued by NVD, and ongoing analysis hints that the scope may change as further information becomes available.
Who is affected
Organisations running OpenShift Pipelines-as-Code (PAC) and related Red Hat services are impacted by this flaw. Affected deployments include those where an attacker with low privileges within a namespace can access the exposed network service used for PAC. Any deployment that allows unverified creation of Repository custom resources is susceptible, provided the attacker has at least create/delete permissions on repositories and secrets within the namespace. Since the vulnerability relies on network exposure and low privileges, any such configuration with exposed services may be at risk, regardless of the specific version of the product in use. Impact is limited to privilege escalation within the namespace, enabling an attacker to read secrets, and to create or modify resources, potentially leading to supply chain compromise. No identities or specific configurations are specified beyond the scope of the attack vector, but the severity underscores the importance of access controls and network segmentation to mitigate exploitation. The vulnerability's CVSS vector indicates that no user interaction is required, and exploitation is straightforward with direct network access.
Recommended actions
- Apply access controls to limit who can create Repository custom resources and secrets within namespaces.
- Restrict network access to exposed PAC services to trusted networks, reducing attack surface.
- Monitor network traffic for unusual activity related to the PAC service or custom resource creation.
- Review and enhance namespace privileges, ensuring least privilege principles are followed.
- Check vendor advisories for updates or patches addressing this vulnerability.
