CVE-2026-127080
|
| |
|
|
Affected software |
KUBERNETES |
|
|
|
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-127080 |
