Red Hat OpenShift PAC Privilege Escalation via Unchecked Repo Creator
CVE-2026-50240 Published on November 6, 2026

Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount
A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.

NVD

Vulnerability Analysis

CVE-2026-50240 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 107 days later.

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-50240 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-50240

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Openshift Builds
Red Hat Openshift Pipelines
Red Hat Serverless
Red Hat Openshift Devspaces
Red Hat Webterminal

Affected Versions

Builds for Red Hat OpenShift: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Dev Spaces: Red Hat Web Terminal: