CVE-2026-127077
|
| |
|
|
Affected software |
KUBERNETES |
|
|
|
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-127077 |
