CVE-2026-33211 Details

A path traversal vulnerability has been identified in the Tekton Pipelines Git resolver, specifically in versions 1.0.0 prior to 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2. The vulnerability arises from the 'pathInRepo' parameter, which is not properly validated, allowing users to read arbitrary files from the resolver pod's filesystem, including sensitive files like ServiceAccount tokens. This file content is then base64-encoded and returned in 'resolutionrequest.status.data', creating a channel for credential exfiltration. The issue was introduced when the Git resolver switched from an in-memory filesystem to using the 'git' binary, enabling path traversal exploits. All releases from 1.0.0 through 1.10.0 are affected, with the exception of the patched versions.

Users can update to Tekton Pipelines versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2, all of which include the necessary patch. After updating, verify that the 'pathInRepo' parameter is no longer vulnerable to traversal attacks and that the Git resolver functions as expected.