CVE-2026-127076: OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API
OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/gitrepo/?all=true and submit any gitrepoid to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated BuildPiper user can exploit it. The attacker does not need elevated privileges or user interaction.
What data can an attacker access?
An attacker can enumerate Git repositories assigned to other projects and trigger builds using their git_repo_id values. This can clone other projects' source code, manifests, and any secrets committed to those repositories.
How can I determine whether the instance is vulnerable?
Instances running a BuildPiper version before 2.7.0 are affected. On an affected instance, an authenticated user can request GET /api/v1/git_repo/?all=true and receive repositories restricted to other projects, then submit another project's git_repo_id to the ci endpoint.