CVE-2026-50240

Name of the Vulnerable Software and Affected Versions OpenShift Pipelines-as-Code (affected versions not specified)

Description OpenShift Pipelines-as-Code (PAC) fails to verify if the creator of a Repository custom resource possesses the necessary permissions to create PipelineRuns. A user with limited permissions to create or delete Repository and Secret resources can trigger the execution of attacker-controlled PipelineRuns. These runs operate under the auto-provisioned pipeline ServiceAccount, which typically holds ClusterRole/edit permissions. This leads to namespace-scoped privilege escalation, allowing unauthorized reading of Secrets, creation, modification, or deletion of resources, and the possibility of supply chain injection within CI/CD namespaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.