9.6
Critical
CVE-2026-33211 Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines
Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Builds 1.6.5 1776859898 | earliest → < 1776859898 | 1776859898 |
| Red Hat OpenShift Builds 1.7.3 1776860241 | earliest → < 1776860241 | 1776860241 |
| Red Hat OpenShift Pipelines 1.21 1774871390 | earliest → < 1774871390 | 1774871390 |
| Red Hat OpenShift Pipelines 1.2 1779865001 | earliest → < 1779865001 | 1779865001 |
| Red Hat Trusted Artifact Signer 1.3 1776339099 | earliest → < 1776339099 | 1776339099 |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Builds for Red Hat OpenShift | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| pipeline 1.10 | 1.10.0 → < 1.10.2 | 1.10.2 |
| pipeline 1.7 | 1.7.0 → < 1.9.2 | 1.9.2 |
| pipeline 1.4 | 1.4.0 → < 1.6.1 | 1.6.1 |
| pipeline 1.1 | 1.1.0 → < 1.3.3 | 1.3.3 |
| pipeline 1.0 | 1.0.0 → < 1.0.1 | 1.0.1 |
| Red Hat OpenShift Builds 1.7.4 1776860241 | earliest → < 1776860241 | 1776860241 |
| Builds for Red Hat OpenShift 1.6.0 1776859898 | earliest → < 1776859898 | 1776859898 |
| Red Hat OpenShift Builds 1.7.1 1776860241 | earliest → < 1776860241 | 1776860241 |
| Red Hat OpenShift Builds 1.6.4 1776859898 | earliest → < 1776859898 | 1776859898 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Builds 1.6.5
The 6 CVEs of Red Hat OpenShift Builds 1.6.5 →
CVE-2026-33810
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…
7.5
High
CVE-2026-33186
gRPC-Go is the Go language implementation of gRPC
9.1
Critical
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs
7.5
High
CVE-2026-27137
When verifying a certificate chain which contains a certificate containing multiple email address constraints which…
7.5
High