CVE-2026-127081: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign projectenvid. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipelineid}/stages/ endpoint, persisting cross-project associations that bypass project separation.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the privileges needed to submit a pipeline-stage creation request. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What is the practical impact of exploitation?
An attacker can associate a pipeline stage with an environment belonging to a different project, bypassing intended project separation. The reported impact is unauthorized modification of cross-project associations; confidentiality and availability impacts are not identified.
How can I check for possible exploitation?
Review pipeline stages created through POST /api/v1/pipeline/{pipeline_id}/stages/ and identify any whose project_env_id refers to an environment owned by a different project than the pipeline. Such persisted cross-project environment associations are an indicator of exposure or misuse.
What should be done if the installation is vulnerable?
Upgrade BuildPiper to version 2.7.0 or later. Until upgrading, restrict which authenticated users can create pipeline stages and review or remove cross-project stage-to-environment associations.