CVE-2026-40938
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability in Tekton Pipelines allows an attacker to inject flags into the git fetch command via the git resolver's revision parameter. Lack of validation that the parameter does not start with a hyphen enables arbitrary binary execution on the resolver pod. Combined with allowed local filesystem URLs, an attacker can escalate privileges and exfiltrate cluster-wide secrets.
Risk Assessment
The risk for the organization includes full Kubernetes cluster compromise, as the resolver pod has access to all secrets in the cluster. An attacker can exfiltrate sensitive data such as passwords, API keys, and certificates, leading to a breach of the entire infrastructure.
Recommendation
Immediately upgrade Tekton Pipelines to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, or 1.11.1 depending on your branch. Additionally, restrict the ability to create ResolutionRequest objects to trusted entities only.
Other vulnerabilities in Tekton Pipelines
See all- CVE-2026-33211Critical
A path traversal vulnerability in the Tekton Pipelines git resolver via the `pathInRepo` parameter allows tenants with `ResolutionRequests` creation permissions to read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens.
- CVE-2026-40924Medium
In the Tekton Pipelines project, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns referencing the HTTP resolver can point it at an attacker-controlled HTTP server returning a very large response body within the 1-minute timeout, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types run in the same pod, crashing it denies resolution service to the entire cluster, and repeated exploitation causes a sustained crash loop.
- CVE-2026-40923Medium
Tekton Pipelines starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 contains a validation bypass in the VolumeMount path restriction. Using .. path traversal components, volumes can be mounted under restricted /tekton/ internal paths. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
- CVE-2026-40161High
In the Tekton Pipelines project, versions from 1.0.0 to 1.0.1 and 1.3.4, 1.6.2, 1.9.3, 1.11.1, the Git resolver in API mode sends the configured Git API token to a user-controlled serverURL when the token parameter is omitted. A user with TaskRun or PipelineRun create permissions can exfiltrate the shared API token.
- CVE-2026-25542Medium
Vulnerability in Tekton Pipelines from version 0.43.0 prior to 1.0.2, 1.3.4, 1.6.2, 1.9.3 and 1.11.1. Trusted resources verification uses regexp.MatchString, which matches a pattern anywhere in the string, so unanchored patterns can be bypassed by attacker-controlled source strings containing the trusted pattern as a substring, potentially changing the verification mode or keys.
- CVE-2023-37264Low
The Tekton Pipelines project does not validate child UIDs in version 0.35.0 and later, allowing users with access to create TaskRuns to create their own Tasks that the Pipelines controller accepts as child Tasks.
Original NVD description (English source)
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS