CVE-2026-127073: OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest
OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpsTree BuildPiperto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A project user who can submit manifests through the Additional Manifest feature can exploit it. The issue does not require user interaction, but it does require authenticated low-privilege access.
What access can an attacker gain?
An attacker can submit a ClusterRoleBinding that binds a service account to the cluster-admin role. Because the pipeline applies manifests with cluster-wide credentials, this can grant control over all workloads and secrets in the Kubernetes cluster.
Are default deployments affected?
The available information identifies the Additional Manifest feature as the exploitation path, but does not state whether it is enabled by default. Deployments running a version before 2.7.0 should determine whether project users can submit unrestricted additional manifests.
What can be done before upgrading?
Restrict or disable project-user access to the Additional Manifest feature, or ensure submitted manifests cannot create or modify cluster-scoped RBAC resources such as ClusterRoleBindings. Review pipeline credentials and limit their cluster-wide permissions where possible.
How can defenders look for prior exploitation?
Review applied manifests and Kubernetes audit records for unexpected ClusterRoleBindings, particularly bindings that grant cluster-admin to service accounts associated with BuildPiper pipelines or projects. Also inspect those service accounts for recently acquired cluster-admin access.