Tekton Pipelines' git resolver passes the revision parameter directly as a positional argument to 'git fetch' without validating that it does not start with a '-' character. Since git interprets flags from positional arguments, an attacker can inject malicious git fetch flags such as '--upload-pack=<binary>'. Combined with the validateRepoURL function allowing local filesystem paths, a tenant able to submit ResolutionRequest objects can execute arbitrary binaries on the resolver pod. The resolver pod's ServiceAccount holds cluster-wide get/list/watch permissions on all Secrets, enabling an attacker to exfiltrate all cluster secrets upon successful exploitation. This vulnerability affects versions >=1.0.0 and <1.11.1 and is resolved in version 1.11.1.

Successful exploitation allows an attacker with permission to submit ResolutionRequest objects to execute arbitrary code on the resolver pod. Given the resolver pod's ServiceAccount has cluster-wide permissions to access all Secrets, this leads to full cluster-wide secret exfiltration. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

This vulnerability is fixed in Tekton Pipelines version 1.11.1. Users should upgrade to version 1.11.1 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor's versioning information.