CVE-2026-40938

Vulnerability overview

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a te...

Affected product and versions

Product

tektoncd pipeline, Red Hat OpenShift Builds 1.7.3, Red Hat OpenShift Builds 1.8.1

Affected versions

>= >= 1.0.0, < 1.0.2, >= >= 1.2.0, < 1.3.4, >= >= 1.4.0, < 1.6.2, >= >= 1.7.0, < 1.9.3, >= >= 1.10.0, < 1.11.1, >= 1.0.0 < 1.11.0

Fixed versions

1.11.0

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-88