CVE-2026-127078
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.