Read the docs
TI-2026-25632 Aliases CVE-2026-33211GHSA-j5q5-j9gm-2w5c

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00583 48th percentileScored 2026-11-07
Fix Partial pipeline (tektoncd): 1.0.1, 1.3.3, 1.6.1 +2github.com/tektoncd/pipeline (Go): 1.0.1, 1.3.3, 1.6.1 +2Red Hat: 12 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagepipeline1.0.0 to before 1.0.1; 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.21.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2Patch availableCNA
—github.com/tektoncd/pipeline (Go)1.0.0 to before 1.0.11.0.1Patch availableGHSA-j5q5-j9gm-2w5c
—github.com/tektoncd/pipeline (Go)1.1.0 to before 1.3.31.3.3Patch availableGHSA-j5q5-j9gm-2w5c
—github.com/tektoncd/pipeline (Go)1.4.0 to before 1.6.11.6.1Patch availableGHSA-j5q5-j9gm-2w5c
—github.com/tektoncd/pipeline (Go)1.7.0 to before 1.9.21.9.2Patch availableGHSA-j5q5-j9gm-2w5c
—github.com/tektoncd/pipeline (Go)1.10.0 to before 1.10.21.10.2Patch availableGHSA-j5q5-j9gm-2w5c
  • pipeline Vendorbackstage Affected 1.0.0 to before 1.0.1; 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.2 Fixed in 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2 Patch available CNA
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.0.0 to before 1.0.1 Fixed in 1.0.1 Patch available GHSA-j5q5-j9gm-2w5c
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.1.0 to before 1.3.3 Fixed in 1.3.3 Patch available GHSA-j5q5-j9gm-2w5c
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.4.0 to before 1.6.1 Fixed in 1.6.1 Patch available GHSA-j5q5-j9gm-2w5c
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.7.0 to before 1.9.2 Fixed in 1.9.2 Patch available GHSA-j5q5-j9gm-2w5c
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.10.0 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-j5q5-j9gm-2w5c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.2Vulnerablebackstage
cpe:2.3:a:linuxfoundation:tekton_pipelines:1.0.0:*:*:*:*:go:*:*1.0.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:* Versions 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.2 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:tekton_pipelines:1.0.0:*:*:*:*:go:*:* Versions 1.0.0 Vulnerable ·backstage

Remediation

  • Fix · CNA pipeline (tektoncd) Fixed in 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2
  • Fix · GHSA-j5q5-j9gm-2w5c github.com/tektoncd/pipeline (Go) Fixed in 1.0.1 Advisory →
  • Fix · GHSA-j5q5-j9gm-2w5c github.com/tektoncd/pipeline (Go) Fixed in 1.3.3 Advisory →
  • Fix · GHSA-j5q5-j9gm-2w5c github.com/tektoncd/pipeline (Go) Fixed in 1.6.1 Advisory →
  • Fix · GHSA-j5q5-j9gm-2w5c github.com/tektoncd/pipeline (Go) Fixed in 1.9.2 Advisory →
  • Fix · GHSA-j5q5-j9gm-2w5c github.com/tektoncd/pipeline (Go) Fixed in 1.10.2 Advisory →

Red Hat 12 advisories

  • RHSA-2026:24484 Released 2026-06-08 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.2
    • Red Hat OpenShift Pipelines 1.21 serve-tkn-cli-1-21-serve-tkn-cli-1.21.1@amd64, serve-tkn-cli-1-21-serve-tkn-cli-1.21.1@amd64_darwin, serve-tkn-cli-1-21-serve-tkn-cli-1.21.1@amd64_windows +5
  • RHSA-2026:21932 Released 2026-05-29 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.5
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
  • RHSA-2026:21931 Released 2026-05-29 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.5
    • Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9
Show 9 more Red Hat advisories
  • RHSA-2026:11331 Released 2026-04-28 · Red Hat rating Important
    Red Hat OpenShift Builds 1.7.2
    • Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 +1
  • RHSA-2026:11330 Released 2026-04-28 · Red Hat rating Important
    Red Hat OpenShift Builds 1.6.5
    • Builds for Red Hat OpenShift 1.6.0 registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 +1
  • RHSA-2026:10158 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Builds 1.7.2
    • Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 +1
  • RHSA-2026:10155 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Builds 1.6.5
    • Builds for Red Hat OpenShift 1.6.0 registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 +1
  • RHSA-2026:10125 Released 2026-04-23 · Red Hat rating Important
    RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:10066 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.4
    • Red Hat OpenShift Pipelines 1.2 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
  • RHSA-2026:10026 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.4
    • Red Hat OpenShift Pipelines 1.2 registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9
  • RHSA-2026:6170 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.1
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
  • RHSA-2026:6166 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.1
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9, registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
Builds for Red Hat OpenShift 1.6.0Fixed RHSA-2026:10155
Red Hat OpenShift Builds 1.7.3Fixed RHSA-2026:10158
Red Hat OpenShift Pipelines 1.2Fixed RHSA-2026:10026, RHSA-2026:10066, RHSA-2026:21931, RHSA-2026:21932
Red Hat OpenShift Pipelines 1.21Fixed RHSA-2026:24484, RHSA-2026:6166, RHSA-2026:6170
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:10125
Not affected: 7 products
  • Builds for Red Hat OpenShift
  • Builds for Red Hat OpenShift 1.6.0
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Builds 1.7.3
  • Red Hat OpenShift Pipelines 1.2
  • Red Hat OpenShift Pipelines 1.21
  • Red Hat OpenShift Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33211
  2. 2026-10-03 Alias added: GHSA-j5q5-j9gm-2w5c
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-11-06 Fix available: RHSA-2026:6166 · Red Hat

References

Patch 8

Advisory 1

Other 1

  • TI-2026-29590 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVSS 3.1HIGH 8.5
  • TI-2026-29578 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2023-18894 Pipelines do not validate child UIDs CVSS 3.1MEDIUM 4.3
  • TI-2026-28976 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL CVSS 3.1HIGH 7.7
  • TI-2026-25468 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun CVSS 3.1MEDIUM 6.5
  • TI-2026-20651 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching CVSS 3.1MEDIUM 6.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences