Git Fetch Command Vulnerability in Tekton Pipelines by Tekton

CVE-2026-40938

What is CVE-2026-40938?

In Tekton Pipelines, versions prior to 1.11.0 contain a vulnerability in the git resolver's revision parameter handling. It lacks validation, allowing an attacker to inject arbitrary flags into the 'git fetch' command. This situation is exacerbated by the permissive validateRepoURL function, which accepts local filesystem paths. Consequently, a malicious tenant can execute arbitrary binaries on the resolver pod, compromising the tekton-pipelines-resolvers ServiceAccount that has extensive permissions, including the ability to list and watch all Secrets in the cluster. This exposes a significant risk of secret exfiltration throughout the entire Kubernetes environment. The vulnerability is addressed in Tekton Pipelines version 1.11.1.

References