CVE-2026-33211 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
Attackers with ResolutionRequest creation permissions can read arbitrary files, including ServiceAccount tokens, from the Tekton git resolver pod.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33211?
CVE-2026-33211 is a critical path traversal vulnerability in tektoncd pipeline, published on 23 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
Weakness: CWE-22
Which versions are affected by CVE-2026-33211?
11 open source packages ship an affected version, including github.com/tektoncd/pipeline. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tektoncd/pipeline Go | From 1.0.0 | 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.11.1 |
github.com/tektoncd/pipeline Go | From 1.0.0 | 1.0.1 |
github.com/tektoncd/pipeline Go | From 1.0.0 | 1.0.1 |
github.com/tektoncd/pipeline Go | From 1.1.0 | 1.3.3 |
github.com/tektoncd/pipeline Go | From 1.1.0 | 1.3.3 |
github.com/tektoncd/pipeline Go | From 1.10.0 | 1.10.2 |
5 more packages
github.com/tektoncd/pipeline Go | From 1.10.0 | 1.10.2 |
github.com/tektoncd/pipeline Go | From 1.4.0 | 1.6.1 |
github.com/tektoncd/pipeline Go | From 1.4.0 | 1.6.1 |
github.com/tektoncd/pipeline Go | From 1.7.0 | 1.9.2 |
github.com/tektoncd/pipeline Go | From 1.7.0 | 1.9.2 |
Products include Linuxfoundation Tekton Pipelines.
How do I fix CVE-2026-33211?
Upgrade github.com/tektoncd/pipeline to a fixed version for your release line: 1.0.1, 1.3.3, 1.6.1 or 1.9.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-33211 being exploited?
There is no known exploitation of CVE-2026-33211 in the wild and no public exploit code.
Other vulnerabilities in tektoncd pipeline
- CVE-2026-40161 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
- CVE-2026-40938 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
- CVE-2026-25542 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
- CVE-2026-40924 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
- CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
Sources
Also known as CLEANSTART-2026-BZ35157, GHSA-j5q5-j9gm-2w5c, GO-2026-4761.