Cloudanix VulnDB

CVE-2026-33211

Critical · 9.6

CVSS

9.6

EPSS

0.7%

Published

Mar 24, 2026

CISA due date

—

The record

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard tekton-chains 0 0.26.2-r4
Chainguard tekton-chains-fips 0 0.26.2-r5
Chainguard tekton-pipelines-controller-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-controller-1.9 0 1.9.2-r0
Chainguard tekton-pipelines-entrypoint-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-entrypoint-1.9 0 1.9.2-r0
Chainguard tekton-pipelines-events-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-nop-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-resolvers-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-resolvers-1.9 0 1.9.2-r0
Chainguard tekton-pipelines-sidecarlogresults-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-sidecarlogresults-1.9 0 1.9.2-r0
Chainguard tekton-pipelines-webhook-1.3 0 1.3.3-r0
Chainguard tekton-pipelines-workingdirinit-1.3 0 1.3.3-r0
Chainguard tkn 0 0.44.0-r4
Chainguard tkn-fips 0 0.44.0-r4
Wolfi tekton-chains 0 0.26.2-r4
Wolfi tekton-pipelines-controller-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-controller-1.9 0 1.9.2-r0
Wolfi tekton-pipelines-entrypoint-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-entrypoint-1.9 0 1.9.2-r0
Wolfi tekton-pipelines-events-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-nop-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-resolvers-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-resolvers-1.9 0 1.9.2-r0
Wolfi tekton-pipelines-sidecarlogresults-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-sidecarlogresults-1.9 0 1.9.2-r0
Wolfi tekton-pipelines-webhook-1.3 0 1.3.3-r0
Wolfi tekton-pipelines-workingdirinit-1.3 0 1.3.3-r0
Wolfi tkn 0 0.44.0-r4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2
openSUSE:Tumbleweed tekton-cli 0 0.44.1-1.1

Related vulnerabilities