Tektoncd
Monthly
Argument injection in the Tekton Pipelines git resolver (versions 1.0.0 through 1.11.0) lets a multi-tenant CI/CD user achieve remote code execution on the resolver pod by supplying a crafted 'revision' parameter. Because the revision string is passed unvalidated as a positional argument to 'git fetch', an attacker can smuggle git flags such as '--upload-pack=<binary>'; combined with validateRepoURL permitting local filesystem paths (URLs beginning with '/'), this executes an arbitrary binary. Since the tekton-pipelines-resolvers ServiceAccount has cluster-wide read on all Secrets, this escalates to full cluster secret exfiltration; a proof of concept exists per CISA SSVC, though the EPSS probability is very low (0.07%).
Credential leakage in Tekton Pipelines git resolver allows authenticated users to exfiltrate system-configured Git API tokens (GitHub PAT, GitLab tokens) by directing the resolver to attacker-controlled endpoints. Affects versions 1.0.0 through 1.10.0 when users omit the token parameter in TaskRun or PipelineRun configurations. CVSS 7.7 with scope change reflects cross-tenant credential theft potential in multi-tenant Kubernetes environments. No active exploitation confirmed (not in CISA KEV), but exploitation is straightforward for authenticated cluster users with TaskRun/PipelineRun creation privileges.
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
Unbounded memory allocation in Tekton Pipelines' HTTP resolver allows any authenticated tenant to crash the shared resolver pod for an entire Kubernetes cluster. The `FetchHttpResource` function reads HTTP response bodies without a byte-level size cap, so a low-privileged user who can create TaskRuns or PipelineRuns can direct the resolver at an attacker-controlled server delivering multi-gigabyte responses, exhausting the pod's 4 GiB memory limit and triggering an OOM-kill. Because all resolver types - Git, Hub, Bundle, Cluster, and HTTP - share the same `tekton-pipelines-resolvers` pod, repeated exploitation causes a sustained crash loop that denies CI/CD pipeline resolution to every tenant on the cluster. A PoC is included in the GHSA advisory and SSVC confirms exploit code exists; however, no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.
Argument injection in the Tekton Pipelines git resolver (versions 1.0.0 through 1.11.0) lets a multi-tenant CI/CD user achieve remote code execution on the resolver pod by supplying a crafted 'revision' parameter. Because the revision string is passed unvalidated as a positional argument to 'git fetch', an attacker can smuggle git flags such as '--upload-pack=<binary>'; combined with validateRepoURL permitting local filesystem paths (URLs beginning with '/'), this executes an arbitrary binary. Since the tekton-pipelines-resolvers ServiceAccount has cluster-wide read on all Secrets, this escalates to full cluster secret exfiltration; a proof of concept exists per CISA SSVC, though the EPSS probability is very low (0.07%).
Credential leakage in Tekton Pipelines git resolver allows authenticated users to exfiltrate system-configured Git API tokens (GitHub PAT, GitLab tokens) by directing the resolver to attacker-controlled endpoints. Affects versions 1.0.0 through 1.10.0 when users omit the token parameter in TaskRun or PipelineRun configurations. CVSS 7.7 with scope change reflects cross-tenant credential theft potential in multi-tenant Kubernetes environments. No active exploitation confirmed (not in CISA KEV), but exploitation is straightforward for authenticated cluster users with TaskRun/PipelineRun creation privileges.
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
Unbounded memory allocation in Tekton Pipelines' HTTP resolver allows any authenticated tenant to crash the shared resolver pod for an entire Kubernetes cluster. The `FetchHttpResource` function reads HTTP response bodies without a byte-level size cap, so a low-privileged user who can create TaskRuns or PipelineRuns can direct the resolver at an attacker-controlled server delivering multi-gigabyte responses, exhausting the pod's 4 GiB memory limit and triggering an OOM-kill. Because all resolver types - Git, Hub, Bundle, Cluster, and HTTP - share the same `tekton-pipelines-resolvers` pod, repeated exploitation causes a sustained crash loop that denies CI/CD pipeline resolution to every tenant on the cluster. A PoC is included in the GHSA advisory and SSVC confirms exploit code exists; however, no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.