Kubernetes
CVE-2026-33211
CRITICAL
GHSA-j5q5-j9gm-2w5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate TaskRun with malicious pathInRepo parameter
-
ExploitGit resolver joins path with repository directory
-
ExecutionPath traversal reads arbitrary files
-
ImpactServiceAccount token exfiltrated in base64-encoded response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Tekton Pipelines with git resolver enabled. Attacker must have permission to create ResolutionRequests (via TaskRuns or PipelineRuns). No victim interaction needed. Enables arbitrary file read from resolver pod filesystem including ServiceAccount tokens. |
| Impact | This vulnerability presents critical real-world risk with a CVSS score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The attack vector is network-based with low complexity requiring only low privileges and no user interaction, with scope change enabling privilege escalation from namespace-level to cluster-wide access. The vulnerability is highly exploitable in multi-tenant Kubernetes environments where Tekton Pipelines is deployed, as any tenant with permission to create TaskRuns or PipelineRuns can exploit it. A proof-of-concept exists and was provided by the reporter. The ability to exfiltrate the tekton-pipelines-resolvers ServiceAccount token, which has cluster-wide get, list, and watch permissions on secrets by default, transforms this from a file read vulnerability into a critical privilege escalation path. The combination of low attack complexity, authenticated proof-of-concept availability, and severe impact on confidentiality and integrity in production Kubernetes clusters makes this a genuine priority for remediation despite the lack of reported active exploitation. |
| Exploit ScenarioDerived | An attacker with namespace-scoped permissions to create TaskRuns or PipelineRuns in a multi-tenant Kubernetes cluster creates a malicious TaskRun that uses the git resolver with a pathInRepo parameter set to ../../../../var/run/secrets/kubernetes.io/serviceaccount/token. The resolver returns the ServiceAccount token base64-encoded in the ResolutionRequest status, which the attacker decodes and uses to authenticate as the tekton-pipelines-resolvers ServiceAccount. With the exfiltrated token, the attacker leverages the ServiceAccount's cluster-wide get, list, and watch permissions on secrets to enumerate and read all Secrets across all namespaces in the cluster, escalating from limited tenant access to full credential compromise across the entire Kubernetes environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
The Tekton Pipelines git resolver contains a path traversal vulnerability allowing authenticated tenants to read arbitrary files from the resolver pod's filesystem via the pathInRepo parameter. Affected products include github.com/tektoncd/pipeline versions 1.0.0 through 1.10.0 across multiple release branches. The vulnerability enables credential exfiltration and privilege escalation from namespace-scoped access to cluster-wide secret reading capabilities. A proof-of-concept was provided by the vulnerability reporter Oleh Konko.
RemediationAI
Upgrade to the patched versions in the 1.0.x, 1.3.x, 1.6.x, 1.9.x, or 1.10.x release branches as specified in the vendor security advisory at https://github.com/tektoncd/pipeline/security/advisories/GHSA-j5q5-j9gm-2w5c. The fix implements validation to reject pathInRepo parameters containing .. components and adds a containment check using filepath.EvalSymlinks() to prevent symlink-based escapes. If immediate patching is not possible, restrict which users can create TaskRuns, PipelineRuns, or ResolutionRequests that use the git resolver through Kubernetes RBAC policies. Additionally, reduce the blast radius by scoping the tekton-pipelines-resolvers ServiceAccount's RBAC permissions using a custom ClusterRole with more restrictive rules instead of the default cluster-wide secrets access. Review and audit existing ResolutionRequests for suspicious pathInRepo values that may indicate attempted or successful exploitation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Tekton Pipelines git resolver component, specifically the getFileContent() function in pkg/resolution/resolver/git/repository.go. This is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) path traversal vulnerability introduced in commit 318006c4e3a5 when the implementation switched from the go-git library's in-memory filesystem to using the native git binary with os.ReadFile() operations on the real filesystem. The affected packages are identified via CPE as pkg:go/github.com_tektoncd_pipeline. The pathInRepo parameter accepts user-controlled input without validation against directory traversal sequences like ../, allowing escape from the cloned repository directory to access any file readable by the resolver pod process, including Kubernetes ServiceAccount tokens at well-known paths.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Summary
The Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests (e.g. by creating TaskRuns or PipelineRuns that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in resolutionrequest.status.data.
Details
The git resolver's getFileContent() function in pkg/resolution/resolver/git/repository.go constructs a file path by joining the repository clone directory with the user-supplied pathInRepo parameter:
fileContents, err := os.ReadFile(filepath.Join(repo.directory, path))The pathInRepo parameter is not validated for path traversal sequences. An attacker can supply values like ../../../../etc/passwd to escape the cloned repository directory and read arbitrary files from the resolver pod's filesystem.
The vulnerability was introduced in commit 318006c4e3a5 which switched the git resolver from the go-git library (using an in-memory filesystem that cannot be escaped) to shelling out to the git binary and reading files with os.ReadFile() from the real filesystem.
Impact
Arbitrary file read - A namespace-scoped tenant who can create TaskRuns or PipelineRuns with git resolver parameters can read any file readable by the resolver pod process.
Credential exfiltration and privilege escalation - The resolver pod's ServiceAccount token is readable at a well-known path (/var/run/secrets/kubernetes.io/serviceaccount/token). In the default RBAC configuration, the tekton-pipelines-resolvers ServiceAccount has get, list, and watch permissions on secrets cluster-wide. An attacker who exfiltrates this token gains the ability to read all Secrets across all namespaces, escalating from namespace-scoped access to cluster-wide secret access.
Patches
Fixed in 1.0.x, 1.3.x, 1.6.x, 1.9.x, 1.10.x.
The fix validates pathInRepo to reject paths containing .. components at parameter validation time, and adds a containment check using filepath.EvalSymlinks() to prevent symlink-based escapes from attacker-controlled repositories.
Workarounds
There is no workaround other than restricting which users can create TaskRuns, PipelineRuns, or ResolutionRequests that use the git resolver. Administrators can also reduce the impact by scoping the resolver pod's ServiceAccount RBAC permissions using a custom ClusterRole with more restrictive rules.
Affected Versions
All releases from v1.0.0 through v1.10.0, including all patch releases:
- v1.0.0, v1.1.0, v1.2.0
- v1.3.0, v1.3.1, v1.3.2
- v1.4.0, v1.5.0, v1.6.0, v1.7.0
- v1.9.0, v1.9.1, v1.10.0
Releases prior to v1.0.0 (e.g. v0.70.0 and earlier) are not affected because they used the go-git library's in-memory filesystem where path traversal cannot escape the git worktree.
Acknowledgments
This vulnerability was reported by Oleh Konko (@1seal), who provided a thorough vulnerability analysis, proof-of-concept, and review of the fix. Thank you!
References
- Fix: _(link to merged PR/commit)_
- Introduced in:
318006c4e3a5("fix: resolve Git Anonymous Resolver excessive memory usage")
Executive ViewAI
A critical vulnerability in Tekton Pipelines (CVE-2026-33211) allows authenticated users to read arbitrary files from pipeline infrastructure, including sensitive credentials and secrets. Organizations using affected versions 1.0.0-1.10.0 face immediate risk of credential theft and unauthorized cluster-wide access escalation, potentially compromising entire Kubernetes environments and downstream applications.
Disable the git resolver feature entirely if not critical to operations; implement strict RBAC policies limiting pipeline creation/execution to minimal required users; deploy network policies restricting resolver pod egress; enable audit logging for all PipelineRun and resolver API calls; monitor and restrict pathInRepo parameter values through admission webhooks; require code review for all pipeline configurations before deployment; consider temporary air-gapping of affected clusters from external repositories until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)NVD
Related Vulnerabilities in Path Traversal Vulnerabilities
View all 4More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB