# CVE-2026-50240: Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount Status: published. Published: 2026-11-06. Updated: 2026-11-06. A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces. ## Remediation - workaround: Set legacyPipelineRbac to false in the TektonConfig custom resource. This prevents the OpenShift Pipelines operator from auto-provisioning the openshift-pipelines-edit RoleBinding that grants the pipeline ServiceAccount ClusterRole/edit in every namespace. Warning: this may break existing pipelines that rely on the pipeline ServiceAccount having edit permissions. Simply deleting the openshift-pipelines-edit RoleBinding is NOT sufficient — the operator reconciliation loop will re-create it unless legacyPipelineRbac is set to false. (source: CNA: redhat) ## Affected products and versions - Red Hat / Builds for Red Hat OpenShift (openshift-builds/openshift-builds-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines-client): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-cli-tkn-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-cli-tkn-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-opc-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-operator-proxy-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-operator-proxy-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-operator-webhook-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-operator-webhook-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Pipelines (openshift-pipelines/pipelines-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Serverless (openshift-serverless-1/kn-client-kn-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Serverless (openshift-serverless-1/kn-plugin-func-func-util-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / OpenShift Serverless (openshift-serverless-clients): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Dev Spaces (devspaces/udi-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Web Terminal (web-terminal/web-terminal-tooling-rhel9): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 8.8 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat - CISA KEV: No listing in collected sources - EPSS: Not available - SSVC: Not available - Weaknesses: CWE-862 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/security/cve/CVE-2026-50240 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2484752 (CNA: redhat; issue-tracking, x_refsource_REDHAT) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-50240; retrieved 2026-11-06; source updated 2026-11-06 Revision: e890798646406ec821129a2483a4e0b5b83366284eff50f9572c48bfa9364f29 Canonical: https://y2.dev/cve/CVE-2026-50240 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.