CVE-2026-54167

Name of the Vulnerable Software and Affected Versions Pipelines-as-Code versions prior to 0.48.0

Description Installations using the GitHub App provider are susceptible to credential exfiltration via the webhook endpoint. The system accepted the X-GitHub-Enterprise-Host request header as the API host during token generation. For webhook events containing an installation.id, the controller generated a GitHub App JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—and requested an installation access token without first validating the webhook signature or verifying that the host matched the repository URL. An attacker can send a crafted payload with a controlled host in the X-GitHub-Enterprise-Host header, causing the controller to send the JWT to the attacker's service. This allows the attacker to attempt to mint installation access tokens within the JWT validity window. Additionally, the incoming webhook flow trusted this header during installation lookup and token generation, which requires a valid webhook secret for the target Repository CR.

Recommendations Update to version 0.48.0. Block or strip unexpected X-GitHub-Enterprise-Host headers at the ingress or proxy in front of the webhook endpoint; specifically, reject requests containing this header for GitHub.com installations and allow only the expected hostname for GitHub Enterprise Server installations. Restrict access to the webhook endpoint to trusted Git provider sources. Rotate the GitHub App private key if exploitation is suspected.