CVE-2026-127078: OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign projectenvid. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated BuildPiper user with low privileges can exploit it. The attacker must be able to submit requests to the component environment endpoints and supply a project_env_id belonging to another application.
What could an attacker do after exploiting it?
The attacker can attach another application's environment to their own service. They can then configure CI and trigger builds and deployments using the other application's configuration, registries, and deployment infrastructure.
Which versions are affected?
BuildPiper versions before 2.7.0 are affected. The provided information does not identify any other affected or fixed versions.