Patch Ticker

OpenShift Pipelines-as-Code missing permission check lets users escalate privileges in a namespace

A regular user on a build system can take over project admin rights.

Summary

OpenShift Pipelines-as-Code (PAC) does not verify that the creator of a Repository resource may create PipelineRuns. A user in the same namespace with only Repository and Secret create/delete permissions can run attacker-controlled pipelines, read Secrets and change resources.

Affected when

  • A namespace user with Repository and Secret create/delete permissions
  • The auto-provisioned pipeline ServiceAccount has ClusterRole/edit by default

What to do

Update to the fixed version named in the Red Hat advisory. Before updating, upstream pipelines-as-code 0.42.4 and below, 0.43.0 up to but not including 0.48.2, and 0.49.0 up to but not including 0.50.1 are affected, so check that your product runs a newer version and read the vendor's advisory.

Products and platforms

  • Builds for Red Hat OpenShift
  • OpenShift Pipelines
  • OpenShift Serverless
  • Red Hat OpenShift Dev Spaces
  • Red Hat Web Terminal

CVE IDs

Sources

Times

First published

First seen