CVE-2026-54167

Pipelines as Code (PaC), the CI/CD component that runs Tekton pipelines for source repositories (notably in Red Hat OpenShift Pipelines), trusts a client-supplied X-GitHub-Enterprise-Host header as the API host when processing webhook events that carry an installation.id, before validating the webhook signature or checking the host against the repository URL in the signed payload. An unauthenticated attacker who can simply reach the webhook endpoint can set that header to a host they control, causing the PaC controller to transmit its locally signed GitHub App JWT to the attacker's service. That stolen JWT can then be replayed during its validity window to mint installation access tokens for the GitHub App, subject to the app's installed scopes and permissions. The same flaw affects the incoming-webhook installation-lookup path, though exploiting that path requires knowledge of the valid incoming webhook secret for the target Repository CR. The issue is fixed in 0.37.8, 0.39.6, 0.42.1, and 0.48.0, and no public proof of concept or exploitation in the wild is known.

What to do: Upgrade Pipelines as Code to 0.37.8, 0.39.6, 0.42.1, or 0.48.0 (or the latest release) — OpenShift users should apply the matching OpenShift Pipelines operator update. Until patched, restrict network access to the PaC webhook Route/Ingress (IP allowlisting or internal-only exposure) and monitor controller egress for connections to unexpected hosts. Because exposed JWTs are signed with the GitHub App private key, review GitHub audit logs for anomalous installation token creation and rotate the GitHub App's private key if any suspicious activity is found.