Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.0
CVE-2024-53351: pipecd Service Account Token Accessible due to Insecure Permissions
CVE-2024-53351 · published 1 year ago
Summary
Attackers can access the service account token in pipecd version 0.49, allowing them to take control of the service. This can happen when an attacker is logged in to the system or has network access to the pipecd service. Update to the latest version of pipecd to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | pipe-cd | <= 0.49.0 |
| – | linuxfoundation | pipecd |
<= 0.49.3 cpe:2.3:a:linuxfoundation:pipecd:*:*:*:*:*:*:*:* |
Original advisory text
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
References
- https://gist.github.com/HouqiyuA/948a808b8bd48b17b37a4d5e0b6fb005 URL
- https://pipecd.dev
- https://github.com/advisories/GHSA-4jhw-c53w-w5r7
- https://pipecd.dev/ URL
- https://nvd.nist.gov/vuln/detail/CVE-2024-53351 Vendor Advisory
- https://github.com/pipe-cd/pipecd Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53351... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-276Incorrect Default Permissions
CWE-284Improper Access Control
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published21 Mar 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta