OpsTree BuildPiper: unrestricted Additional Manifests let project users gain Kubernetes cluster-admin

Impact

BuildPiper applies manifests submitted through its Additional Manifest feature with the pipeline's cluster-wide credentials and does not restrict which kinds of object they contain. A project-level user can submit a ClusterRoleBinding that binds a service account they control to cluster-admin. That gives them every workload and every Secret in the cluster, including other teams' namespaces. On a shared GPU cluster that means one project user can read or take over every tenant's jobs, model weights and credentials.

Who can reach it

An authenticated BuildPiper project user who can use the Additional Manifest feature. Login is required, but no cluster RBAC rights are needed beyond what BuildPiper's own credentials carry.

What to do

Upgrade BuildPiper to 2.7.0 or later. The record does not describe a workaround. Until you upgrade, reduce the RBAC held by the credentials BuildPiper deploys with, or block cluster-scoped RBAC objects with admission policy. After upgrading, check for ClusterRoleBindings or RoleBindings to cluster-admin created through the pipeline, and rotate the cluster Secrets if any exist.

References

Related entries

• OpsTree BuildPiper: unrestricted hostPath volumes let deploy users mount the worker node root filesystemCVE-2026-127080 · OpsTree BuildPiper (Define HostPath Volume deploy configuration)Critical
• GitLab: an unauthenticated GraphQL directive can modify or delete public projects and user dataCVE-2026-19478 · GitLab CE/EE (GraphQL API directive handling)Critical
• Apache Polaris: wildcards in table names widen vended S3 credentials to other tablesCVE-2026-42810 · Apache Polaris (S3 delegated-credential policy generation)Critical
• CloudNativePG: a database owner escalates to PostgreSQL superuser and OS command execution in the podCVE-2026-55769 · CloudNativePG instance manager (unpinned search_path on superuser connections)Critical
• Gitea act_runner: workflow container options bypass privileged:false and escape to the hostCVE-2026-58053 · Gitea act_runner Docker backend (workflow container.options handling)Critical
• CloudNativePG instance manager (PostgreSQL connection search_path): The owner of any managed database — a roleNCVD-2026-048-cloudnativepg-instance-manager-p · CloudNativePG instance manager (PostgreSQL connection search_path)Critical