{"id":"EUVD-2026-24165","revision":"207811b7a6cb40c0b83d68d833fb8063","records":[{"revision":"207811b7a6cb40c0b83d68d833fb8063","observedAt":"2026-10-28T05:00:59.341+00:00","statement":{"source":"euvd","id":"EUVD-2026-24165","aliases":["CVE-2026-40161","GHSA-wjxp-xrpv-xpff"],"title":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the syste…","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":null}],"references":["https://github.com/tektoncd/pipeline/security/advisories/GHSA-wjxp-xrpv-xpff","https://github.com/tektoncd/pipeline/issues/9608","https://github.com/tektoncd/pipeline/issues/9609"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24165","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 21, 2026, 4:26:27 PM","dateUpdated":"May 21, 2026, 9:20:13 PM"},"relatedAdvisories":[{"id":"RHSA-2026:24484","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2","vulnerabilityIds":["CVE-2026-33186","CVE-2026-33211","CVE-2026-34986","CVE-2026-40161","CVE-2026-40938"]},{"id":"RHSA-2026:24359","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.3","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40161","CVE-2026-40938"]},{"id":"RHSA-2026:89131","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-40161","CVE-2026-40938","CVE-2026-46600","CVE-2026-56851","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78667","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445","CVE-2026-97031","CVE-2026-111943","CVE-2026-114406"]},{"id":"RHSA-2026:89041","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-40161","CVE-2026-40938","CVE-2026-46600","CVE-2026-56851","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78667","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445","CVE-2026-97031","CVE-2026-111943"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24165","identifiers":["EUVD-2026-24165","CVE-2026-40161","GHSA-wjxp-xrpv-xpff"]},"retained":false,"historicalAffected":[]}],"coverage":[]}