CVE-2026-127080

Name of the Vulnerable Software and Affected Versions OpsTree BuildPiper versions prior to 2.7.0

Description An improper authorization issue allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. By setting the host path to / in the Define HostPath Volume configuration, an attacker can mount the worker node root filesystem with read-write access. This action breaks container isolation, potentially leading to the compromise of the node and the entire cluster.

Recommendations Update to version 2.7.0.