← CVE Radar
CVE-2026-127073OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest
OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.
9.4 CRITICALNot in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Technologies Affected |
|---|---|---|---|
| 9.4 | CRITICAL | 4.0VulnCheck (CNA) | OpsTree Solutions BuildPiper |
| 9.9 | CRITICAL | 3.1VulnCheck (CNA) |
Details
- CVE ID
- CVE-2026-127073
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 13, 2026
- Last modified
- 2026-11-13 10:18 UTC
- Weaknesses
- CWE-269 · Improper Privilege Management
Affected Products
As published by the CNA in the CVE record.
OpsTree SolutionsBuildPiper1 version range
- before 2.7.0