OpsTree Solutions vulnerabilities
We track 7 vulnerabilities in OpsTree Solutions products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest OpsTree Solutions vulnerabilities
- 9.9 Critical severity
BuildPiper: Improper Privilege Management
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define Host
- 7.4 High severity
BuildPiper: Improper Restriction of Excessive Authentication Attempts
OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the targe
- 7.1 High severity
BuildPiper: Authorization Bypass Through User-Controlled Key
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and
- 7.1 High severity
BuildPiper: Missing Authorization
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /a
- 9.9 Critical severity
BuildPiper: Improper Privilege Management
OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBind
- 7.5 High severity
REMS: Missing Authentication for Critical Functionality
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invali
- 9.8 Critical severity
REMS: Improper Authentication
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin acco