Junglewise Threat Intelligence

CVE-2026-33211: Tekton Pipelines path traversal in git resolver

CVE-2026-33211 · Severity: critical · CVSS 9.6 · Published 2026-03-24

Technologies: github.com/tektoncd/pipeline (Go), Tekton Pipelines. Vendors: Go, Tekton.

Executive brief

Tekton Pipelines, a tool used to automate software building and deployment on Kubernetes, contains a security flaw in its git integration. An authorized user of the system could exploit this to read sensitive files from the underlying server, such as security tokens. This could allow an attacker to gain broader administrative control over the entire Kubernetes environment.

Technical details

A path traversal vulnerability exists in the Tekton Pipelines git resolver due to insufficient validation of the `pathInRepo` parameter. The root cause was a transition from an in-memory filesystem to using `os.ReadFile` on the local disk without implementing path sanitization. An attacker with permissions to create `ResolutionRequests`, `TaskRuns`, or `PipelineRuns` can use traversal sequences (e.g., `../../`) to access files outside the intended repository directory. This includes sensitive Kubernetes ServiceAccount tokens, which are returned base64-encoded in the `resolutionrequest.status.data` field. The fix implements path validation to reject '..' components and switches to `git show` to ensure files are read from the git object store rather than the host filesystem.

Affected products

  • Tekton Pipelines >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2

Timeline

  • 2026-03-24: advisory: NVD publication date
  • 2026-03-17: patched: Fix committed to repository

References

Related threats