MEDIUM 6.5 GitHub
CVE-2026-54168
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
### Impact
When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation.
This allows a user with push access to any repository in the installation to craft a PipelineRun with a remote task annotation pointing at a private repository in the same installation:
```
pipelinesascode
Affected Products
- go/github.com/openshift-pipelines/pipelines-as-code < 0.37.8
- go/github.com/openshift-pipelines/pipelines-as-code >= 0.38.0, < 0.39.6
- go/github.com/openshift-pipelines/pipelines-as-code >= 0.40.0, < 0.42.1
- go/github.com/openshift-pipelines/pipelines-as-code >= 0.43.0, < 0.48.0
References
- https://github.com/advisories/GHSA-6f2p-296r-cc28
- https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28
- https://github.com/advisories/GHSA-6f2p-296r-cc28
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-20 via GitHub. Affected: go/github.com/openshift-pipelines/pipelines-as-code < 0.37.8, go/github.com/openshift-pipelines/pipelines-as-code >= 0.38.0, < 0.39.6, go/github.com/openshift-pipelines/pipelines-as-code >= 0.40.0, < 0.42.1 and 1 more.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.