{"id":"EUVD-2026-24491","revision":"fa5a7107ccda4d968eafa2b32b5ac7ed","records":[{"revision":"fa5a7107ccda4d968eafa2b32b5ac7ed","observedAt":"2026-10-28T05:06:26.054+00:00","statement":{"source":"euvd","id":"EUVD-2026-24491","aliases":["CVE-2026-40938","GHSA-94jr-7pqp-xhcq"],"title":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a…","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.5,"severity":null}],"references":["https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq","https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24491","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 21, 2026, 8:45:24 PM","dateUpdated":"Sep 7, 2026, 12:04:45 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-1550","title":"Red Hat OpenShift: Schwachstelle ermöglicht Codeausführung und Offenlegung von Informationen","vulnerabilityIds":["CVE-2026-40938"]},{"id":"RHSA-2026:17546","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.8.0","vulnerabilityIds":["CVE-2026-40938"]},{"id":"RHSA-2026:89131","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-40161","CVE-2026-40938","CVE-2026-46600","CVE-2026-56851","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78667","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445","CVE-2026-97031","CVE-2026-111943","CVE-2026-114406"]},{"id":"RHSA-2026:89041","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-40161","CVE-2026-40938","CVE-2026-46600","CVE-2026-56851","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78667","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445","CVE-2026-97031","CVE-2026-111943"]},{"id":"RHSA-2026:24359","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.3","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40161","CVE-2026-40938"]},{"id":"RHSA-2026:26519","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2","vulnerabilityIds":["CVE-2026-27141","CVE-2026-33186","CVE-2026-33816","CVE-2026-40938"]},{"id":"RHSA-2026:24484","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2","vulnerabilityIds":["CVE-2026-33186","CVE-2026-33211","CVE-2026-34986","CVE-2026-40161","CVE-2026-40938"]},{"id":"RHSA-2026:26538","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2","vulnerabilityIds":["CVE-2026-27141","CVE-2026-40938"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24491","identifiers":["EUVD-2026-24491","CVE-2026-40938","GHSA-94jr-7pqp-xhcq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}