# CVE-2026-50240: Red Hat OpenShift Pipelines-as-Code privilege escalation in Repository creation

Source: https://junglewise.ai/threats/cve-2026-50240-a-flaw-was-found-in-openshift-pipelines-as-code-pac-pac-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-50240 · Severity: high · CVSS 8.8 · Published 2026-11-06

OpenShift Pipelines-as-Code (PAC) is a CI/CD automation system for Kubernetes that executes containerized pipelines. A flaw allows a namespace user with limited permissions to create malicious PipelineRuns that execute with elevated privileges as the default pipeline service account, potentially exposing secrets, modifying resources, and injecting malicious code into the software supply chain.

Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-50240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50240 being exploited in the wild.

**How severe is CVE-2026-50240?** High severity, with a CVSS score of 8.8, published 6 November 2026.

**Which products and versions are affected?** Red Hat OpenShift Pipelines-as-Code.

**Is there a fix for CVE-2026-50240?** No fixed version is recorded yet. Set legacyPipelineRbac to false in the TektonConfig custom resource to prevent auto-provisioning of the openshift-pipelines-edit RoleBinding. Note that this may break existing pipelines that depend on the pipeline ServiceAccount having edit permissions; simply deleting the binding is insufficient as the operator will reconcile it back unless the configuration setting is changed.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-06"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50240 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50240?** Check whether you run Red Hat OpenShift Pipelines-as-Code. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Set legacyPipelineRbac to false in the TektonConfig custom resource to prevent auto-provisioning of the openshift-pipelines-edit RoleBinding. Note that this may break existing pipelines that depend on the pipeline ServiceAccount having edit permissions; simply deleting the binding is insufficient as the operator will reconcile it back unless the configuration setting is changed.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-06"}]

## Technical details

The vulnerability is a missing authorization check (CWE-862) where PAC does not verify whether a Repository custom resource creator has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can exploit this to execute attacker-controlled pipelines as the auto-provisioned pipeline ServiceAccount, which has ClusterRole/edit by default, resulting in namespace-scoped privilege escalation. This enables unauthorized Secret reads, resource modification, and supply chain injection in CI/CD namespaces.

## Affected products

- Red Hat OpenShift Pipelines-as-Code

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-50240](https://access.redhat.com/security/cve/CVE-2026-50240)