EUVD-2026-24491
GHSA-94jr-7pqp-xhcq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Tenant must be authenticated to submit requests (PR:L) and chain two behaviors with a controllable local binary (AC:H); RCE on the resolver pod crosses into cluster-wide secret access, changing scope (S:C) with full C/I/A impact.
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 1.0.0 to before 1.11.0, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. This vulnerability is fixed in 1.11.1.
AnalysisAI
Argument injection in the Tekton Pipelines git resolver (versions 1.0.0 through 1.11.0) lets a multi-tenant CI/CD user achieve remote code execution on the resolver pod by supplying a crafted 'revision' parameter. Because the revision string is passed unvalidated as a positional argument to 'git fetch', an attacker can smuggle git flags such as '--upload-pack=<binary>'; combined with validateRepoURL permitting local filesystem paths (URLs beginning with '/'), this executes an arbitrary binary. Since the tekton-pipelines-resolvers ServiceAccount has cluster-wide read on all Secrets, this escalates to full cluster secret exfiltration; a proof of concept exists per CISA SSVC, though the EPSS probability is very low (0.07%).
Technical ContextAI
Tekton Pipelines is a Kubernetes-native CI/CD framework that exposes 'resolvers' as controllers reconciling ResolutionRequest custom resources to fetch pipeline/task definitions from sources like git. The root cause is CWE-88 (argument injection): in pkg/resolution/resolver/git/repository.go the checkout function invokes execGit('fetch','origin',revision,'--depth=1') where 'revision' is user-controlled and never checked for a leading '-'. Git treats leading-dash positional arguments as options, so a revision like '--upload-pack=/path/to/binary' is parsed as a flag that runs a local program. This is compounded by validateRepoURL (resolver.go:154-158) whose regex '^(/|[^@]+@[^:]+|(git|https?)://)' intentionally allows local filesystem repo paths, giving the attacker a way to point git at a controllable local target. Notably PopulateDefaultParams sanitizes only the pathInRepo parameter (leading-slash strip and containsDotDot), leaving 'revision' entirely unvalidated. The affected package is go/github.com/tektoncd/pipeline (CPE cpe:2.3:a:tektoncd:pipeline).
RemediationAI
Vendor-released patch: upgrade to Tekton Pipelines 1.11.1, or to the corresponding backport for your release line - 1.9.3, 1.6.2, or 1.3.4 - using the install manifest referenced in the release notes (kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.11.1/release.yaml). Red Hat OpenShift Pipelines users should apply the relevant errata (RHSA-2026:17546 / 24359 / 24484 / 26519 / 26538). Where immediate patching is not possible, reduce exposure by restricting who can create ResolutionRequest/TaskRun/PipelineRun objects via RBAC so untrusted tenants cannot invoke the git resolver (trade-off: may block legitimate self-service pipeline authors), and consider disabling the git resolver if unused (enable-git-resolver: false in the resolvers feature-flags ConfigMap, which will break pipelines that resolve tasks from git). Additionally, tighten the tekton-pipelines-resolvers ServiceAccount's cluster-wide Secret access to limit blast radius, accepting that overly narrow scoping can break legitimate secret-backed git auth. Refer to the advisory at https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq for authoritative guidance.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Vendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today