Tekton Pipelines CVE-2026-40938

Exploitation requires a multi-tenant or shared Tekton deployment where the attacker holds RBAC rights to create ResolutionRequest (or TaskRun/PipelineRun) objects that invoke the git resolver - i.e., PR:L authenticated tenant access, not anonymous. The attacker must set the git resolver's 'url' parameter to an attacker-influenced local filesystem path (a URL beginning with '/', which validateRepoURL explicitly allows) and the 'revision' parameter to a git flag such as '--upload-pack=<binary>', and a suitable executable must be reachable on the resolver pod's filesystem. Limiting factors: the git resolver must be enabled, exploitation is rated high complexity (AC:H) because two distinct behaviors must be chained and a controllable binary/path is needed, and the impact is bounded by the tekton-pipelines-resolvers ServiceAccount privileges (which, however, include cluster-wide get/list/watch on Secrets). Affected versions are 1.0.0 through 1.11.0 (and pre-backport releases below 1.9.3/1.6.2/1.3.4).

Signals partially conflict and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) reflects network reach, low-privilege tenant access, high attack complexity (chaining two behaviors and controlling a local path/binary), and a scope change to the whole cluster's secrets. CISA SSVC rates Exploitation as 'poc', Automatable 'no', and Technical Impact 'total' - meaning a working technique is public but not trivially scalable, consistent with the AC:H rating. EPSS is only 0.07% (22nd percentile), and there is no CISA KEV listing, so there is no evidence of widespread active exploitation; the low EPSS despite a serious impact suggests this is a targeted, high-skill attack against multi-tenant clusters rather than mass exploitation. The real priority driver is context: in shared/multi-tenant Tekton deployments where untrusted users can submit ResolutionRequests, the cluster-wide secret blast radius makes this a high-priority patch; in single-tenant or trusted-operator clusters the PR:L barrier and AC:H materially reduce practical risk.

A tenant with permission to submit ResolutionRequests to a shared Tekton cluster crafts a request to the git resolver with a repository URL pointing at a local filesystem path (permitted by validateRepoURL) and a revision value of '--upload-pack=/usr/bin/curl' (or a planted binary). When the resolver runs 'git fetch', git interprets the revision as the --upload-pack flag and executes the attacker-chosen binary on the resolver pod; the attacker then abuses the resolver ServiceAccount's cluster-wide Secret read access to exfiltrate all cluster secrets. A proof of concept is indicated by CISA SSVC (Exploitation: poc), though attack complexity is high.