CVE-2026-33211: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in tektoncd pipeline
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
AI Analysis
Technical Summary
Tekton Pipelines' git resolver suffers from a CWE-22 path traversal vulnerability (CVE-2026-33211) that allows an authenticated user with permission to create ResolutionRequests (e.g., via TaskRuns or PipelineRuns) to read arbitrary files on the resolver pod's filesystem by manipulating the pathInRepo parameter. This includes sensitive files such as ServiceAccount tokens, enabling potential privilege escalation from namespace to cluster scope. The vulnerability affects versions >=1.0.0 and prior to 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2. The issue has been patched in these fixed versions. The vulnerability has a CVSS v3.1 score of 9.6 (critical) with network attack vector, low complexity, low privileges required, no user interaction, and scope change with high confidentiality and integrity impacts but no availability impact. Mitigation includes restricting ResolutionRequest creation to trusted users and applying strict RBAC policies. Vendor advisories from Red Hat confirm the vulnerability and patch availability.
Potential Impact
An attacker with permission to create ResolutionRequests can read any file accessible by the resolver pod, including sensitive cluster secrets such as ServiceAccount tokens. This leads to information disclosure and potential privilege escalation from namespace-level access to cluster-wide access. The vulnerability compromises confidentiality and integrity but does not affect availability. The CVSS score of 9.6 reflects the critical severity of this flaw.
Mitigation Recommendations
Apply the official patches by upgrading to Tekton Pipelines versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2 or later, which contain fixes for this vulnerability. Additionally, restrict the creation of ResolutionRequests to trusted users and service accounts by implementing strict Role-Based Access Control (RBAC) policies to limit who can create TaskRuns or PipelineRuns that use the git resolver. These measures reduce exposure and prevent unauthorized filesystem access. No other vendor advisories indicate alternative mitigations or that no action is required.
CVE-2026-33211: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in tektoncd pipeline
Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
CVSS v3.1
Score 9.6critical
Affected software
tektoncd
pipeline
pkg:github/tektoncd/pipelineRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Tekton Pipelines' git resolver suffers from a CWE-22 path traversal vulnerability (CVE-2026-33211) that allows an authenticated user with permission to create ResolutionRequests (e.g., via TaskRuns or PipelineRuns) to read arbitrary files on the resolver pod's filesystem by manipulating the pathInRepo parameter. This includes sensitive files such as ServiceAccount tokens, enabling potential privilege escalation from namespace to cluster scope. The vulnerability affects versions >=1.0.0 and prior to 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2. The issue has been patched in these fixed versions. The vulnerability has a CVSS v3.1 score of 9.6 (critical) with network attack vector, low complexity, low privileges required, no user interaction, and scope change with high confidentiality and integrity impacts but no availability impact. Mitigation includes restricting ResolutionRequest creation to trusted users and applying strict RBAC policies. Vendor advisories from Red Hat confirm the vulnerability and patch availability.
Potential Impact
An attacker with permission to create ResolutionRequests can read any file accessible by the resolver pod, including sensitive cluster secrets such as ServiceAccount tokens. This leads to information disclosure and potential privilege escalation from namespace-level access to cluster-wide access. The vulnerability compromises confidentiality and integrity but does not affect availability. The CVSS score of 9.6 reflects the critical severity of this flaw.
Mitigation Recommendations
Apply the official patches by upgrading to Tekton Pipelines versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2 or later, which contain fixes for this vulnerability. Additionally, restrict the creation of ResolutionRequests to trusted users and service accounts by implementing strict Role-Based Access Control (RBAC) policies to limit who can create TaskRuns or PipelineRuns that use the git resolver. These measures reduce exposure and prevent unauthorized filesystem access. No other vendor advisories indicate alternative mitigations or that no action is required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-17T23:23:58.313Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-33211","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10155","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10158","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6170","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:6166","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24484","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10066","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21932","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21931","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10026","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10125","vendor":"Red Hat"}]
Threat ID: 69c1e5e3f4197a8e3bb3f17b
Added to database: 03/24/2026, 01:16:19 UTC
Last enriched: 08/17/2026, 13:16:08 UTC
Last updated: 09/10/2026, 19:46:22 UTC
Views: 221
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.