Tekton Pipelines-as-Code GitHub App Token Vulnerability Warning
- Severity
- HIGH
- Affected component
- pipelines-as-code (github-actions)
- Patched version
- v0.48.0
Tekton Pipelines-as-Code users are reportedly affected by a vulnerability that allows unauthorized access to private repositories due to an unscoped GitHub App installation token.
What happened
An early warning has been issued regarding a vulnerability in Tekton Pipelines-as-Code. The issue involves an unscoped GitHub App installation token that, when configured across multiple repositories, allows unauthorized read-only access to private repositories. This vulnerability is under investigation and has not yet been exploited in the wild.
The vulnerability affects versions of Tekton Pipelines-as-Code up to and including v0.47.0. The recommended action is to upgrade to version v0.48.0 or later and limit the GitHub App installation to only the required repositories. Users should consult the primary sources for the most current information and guidance.
What to do about it
- Upgrade Tekton Pipelines-as-Code to version v0.48.0 or later.
- Limit the GitHub App installation to only the repositories that require it.
- Monitor the primary sources for updates on this vulnerability.
- Review your current configurations and access controls for Tekton Pipelines-as-Code.
- Ensure that all team members are aware of the vulnerability and the steps being taken to mitigate it.
How 0Day would have caught this
pipelines-as-code is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Tekton Pipelines-as-Code version v0.47.0 or earlier, you may be affected by this vulnerability.
What should I do right now?
Upgrade to Tekton Pipelines-as-Code v0.48.0 or later and limit the GitHub App installation to only the required repositories.
Has this vulnerability been exploited in the wild?
No, this vulnerability has not been reported as exploited in the wild.