CVE-2026-127077: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with clusterid and namespaces values. Attackers can modify requests to POST /api/v1/project/{projectid}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to BuildPiper. They also need the ability to submit or modify requests to the environment-creation API endpoint for a project.
What access can an attacker gain through exploitation?
The attacker can create an environment using a Kubernetes cluster assigned to another project by tampering with the cluster_id and namespaces request values. They can then trigger builds and deployments into that other project's cluster, bypassing project isolation.
Are deployments to another project's cluster possible without direct assignment to that cluster?
Yes. The affected environment-creation API does not properly enforce the project-to-cluster assignment when supplied with altered cluster_id and namespaces values.
Which versions are affected?
BuildPiper versions before 2.7.0 are affected. The provided information does not state whether version 2.7.0 or later requires any additional configuration changes.