Vulnerabilities

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's…

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

OpsTree Solutions

Product

BuildPiper

CVSS v3.1

7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness

CWE-639

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-127078 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 18
   CVE NVD 11h ago

   OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to…

   CVSS 4.3 CVE-2026-127081 OpsTree Solutions
2. 30
   CVE NVD 11h ago

   OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned…

   CVSS 7.1 CVE-2026-127077 OpsTree Solutions