CVE-2026-127080: OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpsTree BuildPiperto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated BuildPiper deploy user can exploit it. No user interaction is required.
What access does an attacker need to compromise a worker node?
The attacker needs access to the Define HostPath Volume configuration and the ability to specify a hostPath volume. Setting the host path to / can mount the worker node root filesystem read-write.
Are default hostPath restrictions sufficient to prevent exploitation?
Affected versions do not apply allow-list or policy checks to hostPath volume definitions. A deploy user can define an arbitrary host path, including /.
Which versions need remediation?
BuildPiper versions before 2.7.0 are affected. Upgrading to 2.7.0 or later removes the affected version range described here.