CVE-2026-33211: Tekton Pipelines path traversal in git resolver

CVE-2026-33211 · Severity: critical · CVSS 9.6 · Published 2026-03-24

Tekton Pipelines, a tool used to automate software building and deployment on Kubernetes, contains a security flaw in its git integration. An authorized user of the system could exploit this to read sensitive files from the underlying server, such as security tokens. This could allow an attacker to gain broader administrative control over the entire Kubernetes environment.

Technologies: github.com/tektoncd/pipeline (Go), Tekton Pipelines. Vendors: Go, Tekton.

Quick answers

Is CVE-2026-33211 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33211 being exploited in the wild.
How severe is CVE-2026-33211?
Critical severity, with a CVSS score of 9.6, published 24 March 2026.
Which products and versions are affected?
github.com/tektoncd/pipeline (Go) SEMVER:introduced=1.0.0,fixed=1.0.1, SEMVER:introduced=1.0.0,fixed=1.0.1,introduced=1.1.0,fixed=1.3.3,introduced=1.4.0,fixed=1.6.1,introduced=1.7.0,fixed=1.9.2,introduced=1.10.0,fixed=1.11.1; Tekton Pipelines >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2.
Is there a fix for CVE-2026-33211?
Yes. github.com/tektoncd/pipeline (Go): upgrade to 1.0.1, 1.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33211 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33211?
Check whether you run github.com/tektoncd/pipeline (Go) or Tekton Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/tektoncd/pipeline (Go): upgrade to 1.0.1, 1.11.1 or later
    go get github.com/tektoncd/pipeline@v1.11.1

Technical details

A path traversal vulnerability exists in the Tekton Pipelines git resolver due to insufficient validation of the `pathInRepo` parameter. The root cause was a transition from an in-memory filesystem to using `os.ReadFile` on the local disk without implementing path sanitization. An attacker with permissions to create `ResolutionRequests`, `TaskRuns`, or `PipelineRuns` can use traversal sequences (e.g., `../../`) to access files outside the intended repository directory. This includes sensitive Kubernetes ServiceAccount tokens, which are returned base64-encoded in the `resolutionrequest.status.data` field. The fix implements path validation to reject '..' components and switches to `git show` to ensure files are read from the git object store rather than the host filesystem.

Affected products

  • Tekton Pipelines >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2

Identifiers

  • CVE-2026-33211
  • GHSA-j5q5-j9gm-2w5c
  • GO-2026-4761

Timeline

  • 2026-03-24: advisory: NVD publication date
  • 2026-03-17: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.