CVE-2026-40161 Details
Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
A vulnerability exists in the Tekton Pipelines Git resolver when used in API mode, specifically in versions 1.0.0 through 1.10.0. The issue arises because the resolver sends the system-configured Git API token to a user-controlled server URL if the user does not provide a token. This allows a tenant with permission to create TaskRuns or PipelineRuns to exfiltrate sensitive API tokens, such as GitHub Personal Access Tokens or GitLab tokens, by directing the server URL to an attacker-controlled endpoint.
Do not configure a system-level API token in the Git resolver ConfigMap. Instead, require users to provide their own tokens via the token parameter. Additionally, restrict TaskRun creation to limit which users or ServiceAccounts can create TaskRuns and PipelineRuns that use the Git resolver.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tektoncd/pipeline/issues/9608 | [email protected] | Issue Tracking |
| https://github.com/tektoncd/pipeline/issues/9609 | [email protected] | Issue Tracking |
| https://github.com/tektoncd/pipeline/security/advisories/GHSA-wjxp-xrpv-xpff | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation tekton pipelines | >= 1.0.0, <= 1.10.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | [email protected] |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |