CVE-2026-127077
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.