CVE-2026-40938 is a command injection vulnerability in Tekton Pipelines, a CI/CD system component used in Red Hat OpenShift Builds. An authenticated user able to submit ResolutionRequest objects can inject malicious commands into the git resolver's revision parameter, which is passed unchecked as a positional argument to the git fetch command. The vulnerability is compounded by the acceptance of repository URLs starting with '/' that point to local filesystem paths, allowing an attacker to execute arbitrary binaries on the resolver pod. Successful exploitation can lead to exfiltration of all cluster-wide secrets, significant information disclosure, and potential privilege escalation or lateral movement within the cluster. The vulnerability is rated high severity with a CVSS v3 base score of 8.5. Red Hat advises upgrading from affected versions to OpenShift Builds 1.8.0.

An attacker with authentication and the ability to submit ResolutionRequest objects can execute arbitrary code on the resolver pod, leading to full exfiltration of cluster-wide secrets. This compromises the confidentiality and integrity of the OpenShift environment. Depending on kubeconfig contents, attackers may escalate privileges or move laterally within the cluster, increasing the risk of further compromise.

Red Hat recommends upgrading existing Red Hat OpenShift Builds installations from affected versions to version 1.8.0, which contains the fix. No alternative mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are currently available. Users should follow the official Red Hat advisory and update promptly.