9.6
Critique
CVE-2026-33211 Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines
Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Builds 1.6.5 1776859898 | premières → < 1776859898 | 1776859898 |
| Red Hat OpenShift Builds 1.7.3 1776860241 | premières → < 1776860241 | 1776860241 |
| Red Hat OpenShift Pipelines 1.21 1774871390 | premières → < 1774871390 | 1774871390 |
| Red Hat OpenShift Pipelines 1.2 1779865001 | premières → < 1779865001 | 1779865001 |
| Red Hat Trusted Artifact Signer 1.3 1776339099 | premières → < 1776339099 | 1776339099 |
| OpenShift Pipelines | Versions non publiées | |
| OpenShift Serverless | Versions non publiées | |
| Builds for Red Hat OpenShift | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées |
Afficher les 10 autres branches Masquer les 10 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Virtualization 4 | Versions non publiées | |
| pipeline 1.10 | 1.10.0 → < 1.10.2 | 1.10.2 |
| pipeline 1.7 | 1.7.0 → < 1.9.2 | 1.9.2 |
| pipeline 1.4 | 1.4.0 → < 1.6.1 | 1.6.1 |
| pipeline 1.1 | 1.1.0 → < 1.3.3 | 1.3.3 |
| pipeline 1.0 | 1.0.0 → < 1.0.1 | 1.0.1 |
| Red Hat OpenShift Builds 1.7.4 1776860241 | premières → < 1776860241 | 1776860241 |
| Builds for Red Hat OpenShift 1.6.0 1776859898 | premières → < 1776859898 | 1776859898 |
| Red Hat OpenShift Builds 1.7.1 1776860241 | premières → < 1776860241 | 1776860241 |
| Red Hat OpenShift Builds 1.6.4 1776859898 | premières → < 1776859898 | 1776859898 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Builds 1.6.5
Les 6 CVE de Red Hat OpenShift Builds 1.6.5 →
CVE-2026-33810
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…
7.5
Élevée
CVE-2026-33186
gRPC-Go is the Go language implementation of gRPC
9.1
Critique
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs
7.5
Élevée
CVE-2026-27137
When verifying a certificate chain which contains a certificate containing multiple email address constraints which…
7.5
Élevée