—

GO-2026-6263

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code

Quick fix

GO-2026-6263 — github.com/openshift-pipelines/pipelines-as-code: upgrade to the fixed version with the command below.

go get github.com/openshift-pipelines/pipelines-as-code@v0.37.8

Details

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/openshift-pipelines/pipelines-as-code

Introduced in: 0 Fixed in: 0.37.8

Fix go get github.com/openshift-pipelines/pipelines-as-code@v0.37.8

References

https://github.com/tektoncd/pipelines-as-code/security/advisories/GHSA-6f2p-296r-cc28 [ADVISORY]