CVE-2026-127080
CRITICAL
NVD
CVSS Score
9.9
Severity
CRITICAL
Published
Nov 13, 2026
Vendor
unknown
Description
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.