Tekton Pipelines, a Kubernetes-style CI/CD pipeline project, has a path traversal vulnerability (CWE-22) in its git resolver component. The vulnerability exists in versions starting from 1.0.0 and prior to 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2. It allows a tenant with permission to create ResolutionRequests (such as by creating TaskRuns or PipelineRuns using the git resolver) to specify a crafted `pathInRepo` parameter that escapes the intended directory restrictions. This enables reading arbitrary files from the resolver pod's filesystem, including sensitive files like ServiceAccount tokens. The contents of these files are returned base64-encoded in the resolutionrequest.status.data field. The vulnerability has a CVSS 3.1 score of 9.6 (critical) with network attack vector, low attack complexity, and privileges required. Official patches have been released in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2. Red Hat advisories confirm the availability of fixes.

Exploitation of this vulnerability allows an attacker with limited privileges (permission to create ResolutionRequests) to read arbitrary files on the resolver pod's filesystem. This includes sensitive credentials such as ServiceAccount tokens, which could lead to privilege escalation or further compromise within the Kubernetes environment. The vulnerability does not directly allow code execution or denial of service but compromises confidentiality and integrity of sensitive data.

Official patches addressing this vulnerability are available in Tekton Pipelines versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2. It is strongly recommended to upgrade to one of these fixed versions to remediate the issue. No vendor advisory indicates that the vulnerability is already mitigated without patching, so applying the official updates is necessary. Review and restrict permissions to create ResolutionRequests to trusted users only as a temporary measure.