CVE-2026-12878 is a high severity privilege escalation flaw in the Codefresh platform. An authenticated user can use an API endpoint to gain Admin permissions. Codefresh says all 2.x.x versions before 2.11.15 are affected, and recommends upgrading to 2.11.18, the latest version it names.
What's affected
- Codefresh platform, all 2.x.x versions before 2.11.15, per the Codefresh advisory SA2026-01.
- Fixed: 2.11.15 contains the fix. The advisory recommends 2.11.18 and says 2.11.18 or higher is not affected.
- The advisory does not say whether hosted (SaaS) accounts are covered. It addresses customers who downloaded and installed the listed versions, so ask Codefresh if you use the hosted service.
- Mitigation: the advisory says there is no known mitigation. Upgrading is the only remedy.
Source conflict on severity: the CVE record scores this 8.8 High (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Codefresh advisory rates it High with CVSS 8.7. Both are in the High band. The record's product list also names Linux and Windows, which looks like a platform tag rather than a separate product.
How to check if you're exposed
This applies to Codefresh installations you run yourself. Find the version in the platform's admin settings or your deployment manifests.
helm list -A | grep -i codefresh
kubectl get pods -A -o jsonpath='{..image}' | tr -s ' ' '\n' | sort -u | grep -i codefresh
Compare the version with 2.11.15 and 2.11.18. If you cannot tell, treat the installation as exposed until you confirm. Also list who holds accounts on the platform, because the flaw needs a signed in user.
What to do now
- Confirm whether you run a self-managed Codefresh 2.x installation, and which version.
- Upgrade to 2.11.18 or the latest release your team has validated, and at minimum 2.11.15.
- If you use the hosted service, ask Codefresh to confirm its status.
- Review the Admin role membership and audit logs for unexpected role changes.
- Rotate credentials stored in pipelines if you find evidence of an unplanned Admin account.
Why it matters
The record classifies this as CWE-269 (Improper Privilege Management). An API endpoint let an ordinary authenticated user change their own permissions to Admin. The record does not describe the request, and this post does not guess.
CI and CD platforms hold deployment credentials, cloud keys and secrets for many systems. An Admin on that platform can often reach everything it deploys to, so privilege escalation there has a wide blast radius. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Quick check
Is there a workaround?
Codefresh says there is no known mitigation. Upgrade.
Which fixed version should I choose?
2.11.15 contains the fix, and the advisory recommends 2.11.18.
Sources
Last reviewed: 18 October 2026.
