# CVE-2026-33211: Tekton Pipelines path traversal in git resolver

Source: https://junglewise.ai/threats/cve-2026-33211-tekton-pipelines-path-traversal-in-git-resolver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-24. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33211 · Severity: critical · CVSS 9.6 · Published 2026-03-24

Tekton Pipelines, a tool used to automate software building and deployment on Kubernetes, contains a security flaw in its git integration. An authorized user of the system could exploit this to read sensitive files from the underlying server, such as security tokens. This could allow an attacker to gain broader administrative control over the entire Kubernetes environment.

Technologies: [github.com/tektoncd/pipeline (Go)](https://junglewise.ai/threats/technologies/github-com-tektoncd-pipeline), [Tekton Pipelines](https://junglewise.ai/threats/technologies/pipelines). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Tekton](https://junglewise.ai/threats/vendors/tekton).

## Quick answers

**Is CVE-2026-33211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33211 being exploited in the wild.

**How severe is CVE-2026-33211?** Critical severity, with a CVSS score of 9.6, published 24 March 2026.

**Which products and versions are affected?** github.com/tektoncd/pipeline (Go) SEMVER:introduced=1.0.0,fixed=1.0.1, SEMVER:introduced=1.0.0,fixed=1.0.1,introduced=1.1.0,fixed=1.3.3,introduced=1.4.0,fixed=1.6.1,introduced=1.7.0,fixed=1.9.2,introduced=1.10.0,fixed=1.11.1; Tekton Pipelines >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2.

**Is there a fix for CVE-2026-33211?** Yes. github.com/tektoncd/pipeline (Go): upgrade to 1.0.1, 1.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33211 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33211?** Check whether you run github.com/tektoncd/pipeline (Go) or Tekton Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/tektoncd/pipeline (Go): upgrade to 1.0.1, 1.11.1 or later

  ```sh
  go get github.com/tektoncd/pipeline@v1.11.1
  ```


## Technical details

A path traversal vulnerability exists in the Tekton Pipelines git resolver due to insufficient validation of the `pathInRepo` parameter. The root cause was a transition from an in-memory filesystem to using `os.ReadFile` on the local disk without implementing path sanitization. An attacker with permissions to create `ResolutionRequests`, `TaskRuns`, or `PipelineRuns` can use traversal sequences (e.g., `../../`) to access files outside the intended repository directory. This includes sensitive Kubernetes ServiceAccount tokens, which are returned base64-encoded in the `resolutionrequest.status.data` field. The fix implements path validation to reject '..' components and switches to `git show` to ensure files are read from the git object store rather than the host filesystem.

## Affected products

- Tekton Pipelines >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2

## Identifiers

- CVE-2026-33211
- GHSA-j5q5-j9gm-2w5c
- GO-2026-4761

## Timeline

- 2026-03-24: advisory: NVD publication date
- 2026-03-17: patched: Fix committed to repository

## References

- [https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c](https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c)
- [https://github.com/tektoncd/pipeline/commit/318006c4e3a5](https://github.com/tektoncd/pipeline/commit/318006c4e3a5)
- [https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd](https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd)
- [https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae](https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae)
- [https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e](https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e)
- [https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db](https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db)
- [https://github.com/tektoncd/pipeline/commit/ec7755031a183b345cf9e64bea0e0505c1b9cb78](https://github.com/tektoncd/pipeline/commit/ec7755031a183b345cf9e64bea0e0505c1b9cb78)

## Related threats

- [Tekton Pipelines argument injection in Git resolver revision parameter](https://junglewise.ai/threats/cve-2026-40938-tekton-pipelines-argument-injection-in-git-resolver-revision)
- [Tekton Pipelines DoS via unbounded memory allocation in HTTP resolver](https://junglewise.ai/threats/cve-2026-40924-tekton-pipelines-dos-via-unbounded-memory-allocation-in-http)
- [Tekton Pipelines path traversal in VolumeMount validation](https://junglewise.ai/threats/cve-2026-40923-tekton-pipelines-path-traversal-in-volumemount-validation)
- [Tekton Pipelines credential exfiltration in Git resolver API mode](https://junglewise.ai/threats/cve-2026-40161-tekton-pipelines-credential-exfiltration-in-git-resolver-api-mode)
- [Tekton Pipelines regex bypass in trusted resources verification](https://junglewise.ai/threats/cve-2026-25542-tekton-pipelines-regex-bypass-in-trusted-resources-verification)