← CVE Radar
CVE-2026-127080OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
9.4 CRITICALNot in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Technologies Affected |
|---|---|---|---|
| 9.4 | CRITICAL | 4.0VulnCheck (CNA) | OpsTree Solutions BuildPiper |
| 9.9 | CRITICAL | 3.1VulnCheck (CNA) |
Details
- CVE ID
- CVE-2026-127080
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 13, 2026
- Last modified
- 2026-11-13 10:18 UTC
- Weaknesses
- CWE-269 · Improper Privilege Management
Affected Products
As published by the CNA in the CVE record.
OpsTree SolutionsBuildPiper1 version range
- before 2.7.0