CVE-2026-33211
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A path traversal vulnerability in the Tekton Pipelines git resolver via the `pathInRepo` parameter allows tenants with `ResolutionRequests` creation permissions to read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens.
Risk Assessment
The risk involves potential leakage of sensitive data like ServiceAccount tokens, which could lead to unauthorized access to Kubernetes cluster resources and privilege escalation.
Recommendation
Immediately upgrade Tekton Pipelines to one of the patched versions: 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2. Restrict permissions to create `ResolutionRequests` to trusted entities only.
Original NVD description (English source)
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.