Path Traversal Vulnerability in Tekton Pipelines Git Resolver by Tekton
CVE-2026-33211
9.6CRITICAL
What is CVE-2026-33211?
The Tekton Pipelines git resolver contains a vulnerability that allows tenants with appropriate permissions to execute path traversal attacks via the pathInRepo parameter. This security flaw enables unauthorized access to arbitary files from the resolver pod's filesystem, which may include sensitive information such as ServiceAccount tokens. Affected users should upgrade to the patched versions (1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2) to mitigate this risk.
Affected Version(s)
pipeline >= 1.0.0, < 1.0.1 < 1.0.0, 1.0.1
pipeline >= 1.1.0, < 1.3.3 < 1.1.0, 1.3.3
pipeline >= 1.4.0, < 1.6.1 < 1.4.0, 1.6.1