CVE-2026-40938

설명

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a te...

영향 제품·버전

제품 tektoncd pipeline, Red Hat OpenShift Builds 1.7.3, Red Hat OpenShift Builds 1.8.1

영향 버전 tektoncd pipeline, Red Hat OpenShift Builds 1.7.3, Red Hat OpenShift Builds 1.8.1 >= >= 1.0.0, < 1.0.2, >= >= 1.2.0, < 1.3.4, >= >= 1.4.0, < 1.6.2, >= >= 1.7.0, < 1.9.3, >= >= 1.10.0, < 1.11.1, >= 1.0.0 < 1.11.0

수정 버전 tektoncd pipeline, Red Hat OpenShift Builds 1.7.3, Red Hat OpenShift Builds 1.8.1 1.11.0

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE CWE-88

EPSS 데이터 기준일 2026.08.04