टेक्टन पाइपलाइन्स गिट रिज़ॉल्वर में पाथ ट्रैवर्सल (Path traversal) से मनमाना फ़ाइलें पढ़ने की अनुमति है

The primary impact of CVE-2026-33211 is the unauthorized access to sensitive files within the Tekton Pipelines resolver pod. An attacker with the ability to create ResolutionRequests can exploit this vulnerability to read arbitrary files, including ServiceAccount tokens. Compromising these tokens grants the attacker elevated privileges within the Kubernetes cluster, enabling lateral movement and potentially complete control over the affected environment. The base64-encoded file contents being returned in resolutionrequest.status.data simplifies exfiltration. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file system structures to access restricted resources.

Organizations utilizing Tekton Pipelines for CI/CD workflows, particularly those with complex permission structures granting tenants the ability to create ResolutionRequests, are at risk. Shared Kubernetes clusters where multiple teams or projects share resources are also particularly vulnerable, as a compromised tenant could potentially impact other workloads.

• linux / server:

journalctl -u tekton-git-resolver -g 'pathInRepo' | grep -i 'file content'

• linux / server:

ps aux | grep -i 'github.com/tektoncd/pipeline/pkg/resolution/resolver/git/repository.go'

• generic web:

curl -I 'http://<tekton-resolver-url>/resolutionrequest?pathInRepo=/../../../../etc/passwd' # Check for 200 OK response indicating file access

1. 2026-03-18Disclosure

   disclosure

1. आरक्षित2026-03-17
2. प्रकाशित2026-03-18
3. संशोधित2026-03-25
4. EPSS अद्यतन2026-03-31

The primary mitigation for CVE-2026-33211 is to upgrade Tekton Pipelines to version 1.0.1 or later, which includes the fix for this vulnerability. If immediate upgrade is not feasible, restrict the permissions of tenants who can create ResolutionRequests to minimize the potential attack surface. Implement network policies to limit access to the resolver pod. Consider using a Web Application Firewall (WAF) to filter requests containing potentially malicious path traversal attempts, although this is not a complete solution. After upgrading, verify the fix by attempting to access a non-existent file via the pathInRepo parameter and confirming that access is denied.