External risk intelligence

OpsTree BuildPiper Privilege Escalation via Unrestricted Manifests

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-127073

OpsTree BuildPiper is a CI/CD orchestration platform. While these platforms often have web interfaces, they are typically deployed within internal corporate networks or private cloud VPCs to manage internal infrastructure, rather than being exposed directly to the public internet as a primary edge service.

Privilege Escalation

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in OpsTree BuildPiper allows unauthorized users to gain full administrative control over Kubernetes clusters. This occurs when the system processes specific configurations, enabling an attacker to deploy malicious code that grants elevated privileges. The primary concern is confirming if this technology is in use and if it is exposed to potential compromise.

Unrestricted code processing grants full cluster control.
This could lead to complete compromise of cloud infrastructure.
Confirming usage and exposure is the immediate leadership task.

Attack Path

How an attacker could exploit the issue

An attacker with project user access can exploit this vulnerability by submitting unrestricted manifest files through the Additional Manifest feature. This allows them to deploy a malicious ClusterRoleBinding that grants them administrative control over the entire Kubernetes cluster, including all workloads and sensitive information.

Requires project user access.
Triggered by submitting unrestricted manifests.
Risk: Full cluster compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, project users of OpsTree BuildPiper could gain Kubernetes cluster-admin rights. This is achieved by submitting unrestricted manifests through an "Additional Manifest" feature, allowing the deployment of a ClusterRoleBinding that elevates service account privileges to cluster-admin.

Kubernetes cluster-admin rights are at risk.
Unrestricted manifests can be submitted.
Full control over all workloads and secrets.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, ownership of this vulnerability likely falls to the Platform Engineering or DevOps teams responsible for managing the BuildPiper CI/CD platform and its Kubernetes integration. The initial and most critical step is to identify all instances of BuildPiper within the environment, determine their reachability and business criticality, and then confirm the specific team or owner accountable for each deployment to prioritize remediation efforts.

Platform teams own the issue.
Verify BuildPiper instances and reachability.
Plan maintenance for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpsTree BuildPiper?

OpsTree BuildPiper is a CI/CD orchestration platform designed to automate and manage software delivery pipelines. It integrates closely with Kubernetes environments to help teams deploy applications and manage infrastructure workloads. Organizations use it to streamline the movement of code from development through to production by defining pipeline stages and managing cluster configurations.

What is the vulnerability in CVE-2026-127073?

This vulnerability is classified as Improper Privilege Management (CWE-269). It occurs because the system fails to restrict the types of configuration files, known as manifests, that a user can submit. By exploiting this weakness, a standard project user can bypass intended security boundaries to gain cluster-admin rights, effectively granting them full control over the entire Kubernetes environment.

How is this vulnerability triggered?

The issue is triggered when a project user utilizes the 'Additional Manifest' feature to submit unauthorized or malicious manifest files. The system processes these files using its own high-level permissions. This flaw does not apply to standard pipeline operations that do not involve the 'Additional Manifest' functionality; the risk is specifically tied to the processing of these unrestricted, user-supplied configuration payloads.

Is my instance of BuildPiper at risk?

Risk depends on your deployment setup. According to Halo Surface Signal, while BuildPiper can have a web interface, these tools are often hosted internally or within private VPCs rather than on the public internet. If your instance is reachable from untrusted networks, the potential for exploitation by an unauthorized user increases, making it a higher priority for assessment.

What steps should I take if I use BuildPiper?

The first step is to locate all deployments of BuildPiper within your infrastructure and identify the responsible DevOps or platform engineering teams. Once identified, confirm your current version against the advisory's threshold of 2.7.0. Prioritize limiting access to the 'Additional Manifest' feature and coordinate with your platform team to schedule the necessary updates to a secure version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.