Tekton Pipelines 1.0.0-1.0.1 path traversal via git resolver
CVE-2026-33211 Published on March 23, 2026

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.

NVD

Vulnerability Analysis

CVE-2026-33211 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-33211 has been classified to as a Directory traversal vulnerability or weakness.

Products Associated with CVE-2026-33211

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Openshift Builds

Red Hat Openshift Pipelines

Red Hat Trusted Artifact Signer

Red Hat Serverless

Red Hat Openshift Ai

Red Hat Container Native Virtualization

Affected Versions

tektoncd pipeline:

Version >= 1.0.0, < 1.0.1 is affected.
Version >= 1.1.0, < 1.3.3 is affected.
Version >= 1.4.0, < 1.6.1 is affected.
Version >= 1.7.0, < 1.9.2 is affected.
Version >= 1.10.0, < 1.10.2 is affected.

Red Hat OpenShift Builds 1.6.5: Red Hat OpenShift Builds 1.7.4: Red Hat OpenShift Pipelines 1.21: Red Hat OpenShift Pipelines 1.2: Red Hat Trusted Artifact Signer 1.3: Red Hat OpenShift Pipelines: Red Hat OpenShift Serverless: Builds for Red Hat OpenShift: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Virtualization 4:

Exploit Probability

EPSS

0.49%

Percentile

37.90%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.