ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-54167

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Published Aug 20, 2026 · catalog updated Oct 28, 2026 · Pipelines-as-Code GitHub App token

Last checked Oct 29, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-54167. EPSS is 0.27%. Act only if a listed version of Pipelines-as-Code GitHub App token is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Pipelines-as-Code GitHub App token).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.27%
Remediation
Advisory link
Affected products
Go github.com/openshift-pipelines/pipelines-as-code

## Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an , Pipelines-as-Code generated a GitHub App JWT and requested an installation access token before validating the webhook signature or checking that the Enterprise host matched the repository URL in the signed payload. An attacker who can reach the Pipelines-as-Code webhook endpoint can send a crafted GitHub webhook payload containing an installation ID and set to an attacker-controlled host. During token generation, the controller signs a GitHub App JWT locally and sends it to the selected API host. This can disclose the GitHub App JWT to the attacker-controlled service, allowing the attacker to attempt to mint GitHub App installation access tokens within the JWT validity window, subject to the GitHub App installation and permissions. The incoming webhook flow also trusted during GitHub App installation lookup and token generation. In that path, exploitation requires a valid incoming webhook secret for the target Repository CR. ## Patches The fix validates the webhook signature before GitHub App token generation, verifies that matches the repository URL in the webhook payload, and stops using the request header to select the GitHub Enterprise host for incoming webhook token requests. For incoming webhooks, the Enterprise host is derived from the configured Repository URL instead. ## Workarounds Until a patched release is deployed, operators should block or strip unexpected headers at the ingress or proxy in front of the Pipelines-as-Code webhook endpoint. For GitHub.com installations, reject requests that include this header. For GitHub Enterprise Server installations, allow only the expected Enterprise hostname. Operators should also restrict access to the webh

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/openshift-pipelines/pipelines-as-code0 → 0.37.8
  • Go github.com/openshift-pipelines/pipelines-as-code0.38.0 → 0.39.6
  • Go github.com/openshift-pipelines/pipelines-as-code0.40.0 → 0.42.1
  • Go github.com/openshift-pipelines/pipelines-as-code0.43.0 → 0.48.0

How to fix CVE-2026-54167

  • Upgrade

    CVE-2026-54167 lists a fix boundary at 0.37.8. Compare the installed build with that boundary before you change production.

  • Version check

    Fixed in 0.37.8 · 3 other ranges on the advisory

  • Advisory

    Open the cve_org record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-54167. EPSS is 0.27%. Act only if a listed version of Pipelines-as-Code GitHub App token is installed.

Which versions are affected?

Compare what you have installed with 0 → 0.37.8, 0.38.0 → 0.39.6, 0.40.0 → 0.42.1, 0.43.0 → 0.48.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-345: Insufficient Verification of Data Authenticity. EPSS 0.27%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 20, 2026 · Go Vulnerability Database

    Detected

    ## Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an , Pipelines-as-Code generated a GitHub App JWT and requested an installation access token

  2. Oct 28, 2026 · Go Vulnerability Database

    Fix available

    github.com/openshift-pipelines/pipelines-as-code fixed in 0.48.0; github.com/openshift-pipelines/pipelines-as-code fixed in 0.42.1; github.com/openshift-pipelines/pipelines-as-code fixed in 0.39.6; github.com/openshift-pipelines/pipelines-as-code fixed in 0.37.8

  3. Oct 28, 2026 · Go Vulnerability Database

    Fix available

    github.com/openshift-pipelines/pipelines-as-code fixed in 0.48.0

  4. Oct 28, 2026 · Go Vulnerability Database

    Fix available

    github.com/openshift-pipelines/pipelines-as-code fixed in 0.42.1

  5. Oct 28, 2026 · Go Vulnerability Database

    Fix available

    github.com/openshift-pipelines/pipelines-as-code fixed in 0.39.6

  6. Oct 28, 2026 · Go Vulnerability Database

    Fix available

    github.com/openshift-pipelines/pipelines-as-code fixed in 0.37.8

  7. Oct 28, 2026 · Go Vulnerability Database

    Updated

    ## Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the request header as the GitHub Enterprise API host during GitHub App token generation. For GitHub webhook events containing an , Pipelines-as-Code generated a GitHub App JWT and requested an installation access token

Sources

  • CVE.orgVulnerability recordCVE-2026-54167

    Official CVE identifier

    cve.org
  • Go Vulnerability DatabasePackage advisoryGHSA-f5f4-3hh4-f54m

    Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

    osv.dev

References

Freshness

Last verified in this catalog Oct 28, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseOct 29, 2026
  • CVE.orgOct 28, 2026