CVE-2026-33211 - Vulnerability Analysis
CriticalCVSS: 9.6Last Updated: March 24, 2026
Tekton Pipelines - Path Traversal
Overview
Tekton Pipelines >= 1.0.0 and < 1.0.1, < 1.3.3, < 1.6.1, < 1.9.2, < 1.10.2 contains a path traversal caused by improper validation of the pathInRepo parameter in the git resolver, letting tenants with ResolutionRequest creation permissions read arbitrary files including ServiceAccount tokens, exploit requires tenant permissions.
Severity & Score
Impact
Attackers with tenant permissions can read arbitrary files including sensitive tokens, risking credential theft and further system compromise.
Mitigation
Upgrade to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2 or later.
References
- https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae
- https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e
- https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db
- https://github.com/tektoncd/pipeline/commit/ec7755031a183b345cf9e64bea0e0505c1b9cb78
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-j5q5-j9gm-2w5c
- https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c
- https://github.com/tektoncd/pipeline/commit/318006c4e3a5
- https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd
Social Media Activity(4 posts)
šØ CRITICAL: CVE-2026-33211 in Tekton Pipelines (git resolver) enables path traversal attacks via pathInRepo, exposing sensitive files (like ServiceAccount tokens). Upgrade to fixed versions immediately. Details: https://radar.offseq.com/threat/cve-2026-33211-cwe-22-improper-limitation-of-a-pat-2bb49643 #OffSeq #Tekton #Kubernetes #Infosec
View original post
š“ CVE-2026-33211 - Critical (9.6) Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal vi... š https://www.thehackerwire.com/vulnerability/CVE-2026-33211/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
šØ CRITICAL: CVE-2026-33211 in Tekton Pipelines (git resolver) enables path traversal attacks via pathInRepo, exposing sensitive files (like ServiceAccount tokens). Upgrade to fixed versions immediately. Details: https://radar.offseq.com/threat/cve-2026-33211-cwe-22-improper-limitation-of-a-pat-2bb49643 #OffSeq #Tekton #Kubernetes #Infosec
View original post
š“ CVE-2026-33211 - Critical (9.6) Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal vi... š https://www.thehackerwire.com/vulnerability/CVE-2026-33211/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-33211
- Severity
- Critical
- CVSS Score
- 9.6
- Type
- path_traversal
- Status
- new
- EPSS
- 0.0%
- Social Posts
- 4
CWE
- CWE-22
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N