cve.bz

CVE-2026-33211

9.6 criticalEPSS 0.6%

Critical (9.6) in linuxfoundation tekton pipelines. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/tektoncd/pipeline 1.0.1, 1.10.2, 1.11.1.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.

Severity

CVSS 3.1

9.6 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j5q5-j9gm-2w5cGogithub.com/tektoncd/pipeline>=1.0.0 <1.0.11.0.1
GHSA-j5q5-j9gm-2w5cGogithub.com/tektoncd/pipeline>=1.1.0 <1.3.31.3.3
GHSA-j5q5-j9gm-2w5cGogithub.com/tektoncd/pipeline>=1.4.0 <1.6.11.6.1
GHSA-j5q5-j9gm-2w5cGogithub.com/tektoncd/pipeline>=1.7.0 <1.9.21.9.2
GHSA-j5q5-j9gm-2w5cGogithub.com/tektoncd/pipeline>=1.10.0 <1.10.21.10.2
GO-2026-4761Gogithub.com/tektoncd/pipeline>=1.0.0 <1.0.1
>=1.1.0 <1.3.3
>=1.4.0 <1.6.1
>=1.7.0 <1.9.2
>=1.10.0 <1.11.1		1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.11.1

References

Check your stackJSON