Database/Control plane, storage & DevOps
OpsTree BuildPiper: unrestricted hostPath volumes let deploy users mount the worker node root filesystem
Impact
BuildPiper lets authenticated deploy users define Kubernetes hostPath volumes with no allow-list or policy check. Setting the path to / mounts the worker node's whole root filesystem read-write into their container. That breaks container isolation, gives control of the node, and from there the cluster. On a GPU worker, that node is shared with every other tenant's pods on it. This is a different path from the Additional Manifest escalation (CVE-2026-127073) fixed in the same release.
Who can reach it
An authenticated BuildPiper user with deploy rights who can set the Define HostPath Volume option. No cluster RBAC rights are needed.
What to do
Upgrade BuildPiper to 2.7.0 or later. No vendor workaround is given in the record. Pod Security Admission at the baseline or restricted level, or an admission policy that denies hostPath, blocks the attack whatever BuildPiper submits. After upgrading, check running workloads for hostPath mounts of / or other sensitive host paths.
References
Related entries
- GitLab: an unauthenticated GraphQL directive can modify or delete public projects and user dataCVE-2026-19478 · GitLab CE/EE (GraphQL API directive handling)Critical
- Apache Polaris: wildcards in table names widen vended S3 credentials to other tablesCVE-2026-42810 · Apache Polaris (S3 delegated-credential policy generation)Critical
- CloudNativePG: a database owner escalates to PostgreSQL superuser and OS command execution in the podCVE-2026-55769 · CloudNativePG instance manager (unpinned search_path on superuser connections)Critical
- Gitea act_runner: workflow container options bypass privileged:false and escape to the hostCVE-2026-58053 · Gitea act_runner Docker backend (workflow container.options handling)Critical
- CloudNativePG instance manager (PostgreSQL connection search_path): The owner of any managed database — a roleNCVD-2026-048-cloudnativepg-instance-manager-p · CloudNativePG instance manager (PostgreSQL connection search_path)Critical
- Pure Storage FlashBlade management interface authentication: An attacker authenticates to the FlashBlade managementCVE-2023-4976 · Pure Storage FlashBlade management interface authenticationCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.