Executive brief
Tekton Pipelines-as-Code is a CI/CD automation system that integrates with GitHub to process build pipelines. When configured with a GitHub App installed across multiple repositories, the authentication token issued to process pipeline requests retains access to all repositories in the installation rather than being restricted to the triggering repository. An attacker with push access to any repository in the installation can craft a malicious pipeline configuration to read private code and configuration from other repositories in the same GitHub App installation.
Technical details
This is an authorization bypass vulnerability (CWE-862 / CWE-269) in Tekton Pipelines-as-Code's GitHub App integration. The root cause is improper token scoping: when a GitHub App webhook is processed, the installation token is not automatically scoped to the triggering repository. An authenticated user with push access to any repository within a multi-repository GitHub App installation can exploit this by creating a PipelineRun with a remote task annotation pointing to a private repository (e.g., `pipelinesascode.tekton.dev/task: "https://github.com/org/private-repo/blob/main/.tekton/secret-task.yaml"`). The unscoped token retains access to all repositories, allowing Pipelines-as-Code to resolve and inline the remote task, exposing the target repository's Tekton pipeline definitions. This is a read-only confidentiality breach with no write access exposed. The attack vector is network-based and requires low privileges (push access to one repository). The fix, available in v0.48.0 and backported releases, extracts the repository ID from the webhook payload and re-issues the token scoped to the triggering repository when no explicit scoping configuration is present.
Affected products
- Red Hat Tekton Pipelines-as-Code < 0.37.8, >= 0.38.0 and < 0.39.6, >= 0.40.0 and < 0.42.1, >= 0.43.0 and < 0.48.0
Timeline
- 2026-06-19: disclosed
- 2026-08-20: advisory
- 2026-08-20: patched: Patched versions: 0.37.8, 0.39.6, 0.42.1, 0.48.0