CVE-2026-127073
CRITICAL
NVD
CVSS Score
9.9
Severity
CRITICAL
Published
Nov 13, 2026
Vendor
unknown
Description
OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.