CVE-2026-50240

Summary

OpenShift Pipelines-as-Code (PAC) lacks authorization checks when creating Repository custom resources, allowing low-privileged users to trigger PipelineRuns executed with elevated ServiceAccount permissions (ClusterRole/edit). This enables namespace-scoped privilege escalation, letting attackers read Secrets, modify/delete resources, and inject malicious code into CI/CD pipelines.

Exploitability

Exploitation requires only namespace-level create/delete permissions on Repository and Secret resources, with no user interaction or complex conditions beyond standard cluster access.

Blast radius

Successful exploitation allows full compromise of the target namespace, including credential theft via Secret access and supply chain poisoning by injecting malicious pipeline steps.

Detection

Monitor for PipelineRun resources created with 'pipelines-as-code' annotations where the triggering Repository custom resource was created by a user lacking explicit permission to create PipelineRuns; inspect PAC controller logs for unauthorized reconciliation events and verify ServiceAccount binding mismatches in namespace-scoped ClusterRoleBindings.

Prioritized remediation

Upgrade to OpenShift Pipelines-as-Code version 2.590 or later, which implements proper RBAC validation for Repository-to-PipelineRun creation flows.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.