The vulnerability in OpenShift Pipelines‑as‑Code arises because the operator does not verify that the user creating a Repository custom resource has permission to start PipelineRuns. A namespace user who can create and delete Repositories and Secrets can supply a malicious PipelineRun and have it executed under the auto‑provisioned pipeline ServiceAccount, which by default holds the ClusterRole/edit role. This grants the attacker the ability to read secrets, create or modify resources, delete objects, and potentially inject malicious code into continuous‑integration pipelines. The weakness is a classic missing authorization check (CWE‑862).

This issue affects Red Hat OpenShift Pipelines, OpenShift Build, OpenShift Serverless, Red‑Hat OpenShift Dev Spaces and Red‑Hat Web Terminal. The vulnerability is present in all currently deployed versions of these components, however no specific version range is provided by the CNA. The operator that manages pipelines in OpenShift Pipelines‑as‑Code is the primary affected element.

The CVSS score of 8.8 indicates a high severity of exploitation. No EPSS data is supplied, so the statistical likelihood of exploitation cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation at the moment. Based on the description, the attack vector is likely to be an authenticated user within a namespace who has permission to create Repositories or Secrets; they could then trigger arbitrary PipelineRuns that run with elevated ClusterRole/edit privileges. This makes the flaw a serious namespace‑scoped privilege escalation with potential supply‑chain side effects.