NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
CRITICAL severity

CVE-2026-127080 — BuildPiper

CRITICAL

CVE-2026-127080 is a critical-severity (CVSS 9.9) Improper Privilege Management vulnerability in OpsTree Solutions BuildPiper. A fix is available — see the affected versions and patch details below.

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 13, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.

Affected Products

1 product · 1 configurations
Application
BuildPiperOpsTree Solutions
< 2.7.0
1 version
0

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every OpsTree Solutions BuildPiper deployment and check each version against the affected-products list above.

  2. Fix

    Apply the OpsTree Solutions BuildPiper security patch or hotfix for CVE-2026-127080 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
O3 Security · Runtime Protection

Is CVE-2026-127080 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-127080: BuildPiper (Critical 9.9)