CVE-2026-127080: Critical Kubernetes HostPath Authorization Bypass in BuildPiper — Detection and Remediation Guide

A newly published vulnerability, CVE-2026-127080, exposes a critical flaw in the OpsTree BuildPiper platform prior to version 2.7.0. Rated CVSS 9.9 (CRITICAL) and exploitable remotely over the network, this vulnerability allows authenticated users with deploy permissions to define arbitrary Kubernetes hostPath volumes without allow-list enforcement or policy validation.

In practical terms, an attacker with low-privileged BuildPiper access can set the host path to /, mounting the root filesystem of the worker node read-write into a container. This is a textbook container escape. From there, the attacker can pivot to node compromise and, depending on cluster configuration, move laterally across the entire Kubernetes environment.

This is not a theoretical risk. The attack path is straightforward, requires only authenticated deploy-user access, and results in a complete breakdown of container isolation.

Technical Analysis

Affected Product and Versions

• Product: OpsTree BuildPiper
• Versions Affected: Prior to 2.7.0
• Component: Kubernetes volume configuration workflow ("Define HostPath Volume")
• Environment: Kubernetes clusters managed or deployed via BuildPiper

Vulnerability Details

• CVE: CVE-2026-127080
• CVSS Score: 9.9 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated deploy user)
• User Interaction: None
• Scope: Changed
• Impact: High confidentiality, integrity, and availability impact

Root Cause

The vulnerability stems from improper authorization controls in the BuildPiper deployment pipeline. Specifically, the platform allows users to define hostPath volumes in Kubernetes workloads without enforcing an allow-list or applying policy checks on the host path value.

Attack Chain (Defender Perspective)

1. Initial Access: The attacker authenticates to BuildPiper with deploy-level permissions.
2. Malicious Workload Definition: The attacker creates or modifies a deployment configuration and sets a hostPath volume with path: /.
3. Container Deployment: The workload is scheduled onto a worker node.
4. Container Escape: The container mounts the node’s root filesystem read-write.
5. Node Compromise: The attacker reads sensitive files (e.g., /etc/kubernetes/, kubelet credentials, cloud metadata).
6. Cluster Pivot: Using stolen credentials or service account tokens, the attacker escalates privileges across the cluster.

Exploitation Status

At the time of publication, no public proof-of-concept or confirmed in-the-wild exploitation has been reported. However, the vulnerability is trivially exploitable by any authenticated user with deploy permissions and should be treated as a high-priority internal threat vector.

Detection & Response

Sigma Rules

---
title: Kubernetes HostPath Root Mount via BuildPiper
id: 3c9d2a41-8a2b-4f9a-b8e1-9a1c2d3e4f5a
status: experimental
description: Detects attempts to define or deploy Kubernetes workloads mounting the root filesystem via hostPath, consistent with CVE-2026-127080 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-127080
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.resource: 'pods'
    requestObject.spec.volumes.hostPath.path: '/'
  condition: selection
falsepositives:
  - Legitimate infrastructure tooling (rare) mounting root filesystem
level: critical
---
title: Suspicious Kubernetes Volume Definition with HostPath
id: 7f2a9c31-1b4d-4e8a-9c2f-5d6e7f8a9b0c
status: experimental
description: Detects creation of pods using hostPath volumes, which may indicate container escape attempts.
references:
  - https://attack.mitre.org/techniques/T1611/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.resource: 'pods'
    requestObject.spec.volumes.hostPath.path|contains:
      - '/etc'
      - '/var/lib'
      - '/root'
  condition: selection
falsepositives:
  - Legitimate DaemonSets or node agents
level: high

KQL (Microsoft Sentinel)

// Detect Kubernetes audit logs indicating hostPath root mount
CommonSecurityLog
| where DeviceVendor contains "Kubernetes" or DeviceProduct contains "audit"
| extend Message = tostring(AdditionalExtensions)
| where Message contains '"hostPath"'
| where Message contains '"path":"/"'
| project TimeGenerated, SourceIP, Message
| order by TimeGenerated desc

Velociraptor VQL

-- Hunt for container runtime processes interacting with mounted root filesystem
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'hostPath'
   OR CommandLine =~ '/var/lib/kubelet'
   OR CommandLine =~ 'containerd'
   OR CommandLine =~ 'docker'

Remediation Script

#!/bin/bash
# Detect pods with hostPath root mounts and enforce mitigation

# 1. Identify pods mounting root filesystem
kubectl get pods -A -o json | jq '.items[] | select(.spec.volumes[]?.hostPath.path == "/") | {name: .metadata.name, namespace: .metadata.namespace}'

# 2. Delete offending pods (immediate containment)
for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
  kubectl delete pod -n $ns $(kubectl get pods -n $ns -o json | jq -r '.items[] | select(.spec.volumes[]?.hostPath.path == "/") | .metadata.name') --ignore-not-found
done

# 3. Apply PodSecurityPolicy / OPA Gatekeeper policy (example: deny hostPath /)
cat <<EOF | kubectl apply -f -
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPHostFilesystem
metadata:
  name: deny-hostpath-root
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    allowedHostPaths:
      - pathPrefix: "/var/lib/kubelet"
        readOnly: true
EOF

# 4. Restrict BuildPiper deploy user permissions (manual step required)
echo "Review and restrict BuildPiper deploy user roles to prevent arbitrary volume definitions."

Remediation

Immediate Actions

1. Upgrade BuildPiper to version 2.7.0 or later. This version introduces proper authorization checks for hostPath volume definitions.
2. Audit existing workloads for any use of hostPath volumes, especially those mounting /.
3. Restrict deploy user permissions in BuildPiper to the minimum required scope.

Kubernetes Hardening

• Enforce Pod Security Standards (restricted profile).
• Use OPA Gatekeeper or Kyverno to deny hostPath volumes by default.
• Limit hostPath usage to tightly controlled system namespaces (e.g., kube-system).

Detection Strategy

• Enable and centralize Kubernetes audit logs.
• Alert on any pod creation with hostPath volumes.
• Monitor for anomalies in BuildPiper deployment activity.

Long-Term Recommendations

• Treat CI/CD platforms like BuildPiper as high-privilege control planes.
• Implement strict RBAC and separation of duties.
• Regularly review pipeline configurations for privilege escalation paths.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub