PT-2026-34180 · Unknown · Tekton Pipelines

Kodareef5 + 1 · Published 2026-04-21 · Updated 2026-04-28 · CVE-2026-40938

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 1.0.0 through 1.10.x

Description The git resolver fails to validate the revision parameter, which is passed directly as a positional argument to the git fetch command. This allows an attacker to inject arbitrary flags, such as --upload-pack=<binary>. Additionally, the validateRepoURL function permits URLs starting with /, allowing local filesystem paths. A tenant capable of submitting ResolutionRequest objects can combine these behaviors to execute arbitrary binaries on the resolver pod. Because the tekton-pipelines-resolvers ServiceAccount possesses cluster-wide get, list, and watch permissions on all Secrets, this can lead to full cluster-wide secret exfiltration.

Recommendations Update to version 1.11.1.

Exploit

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-40938

GHSA-94JR-7PQP-XHCQ

Affected Products

Tekton Pipelines

References · 11

• 🔥 https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq · Exploit
• https://osv.dev/vulnerability/GHSA-94jr-7pqp-xhcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40938 · Security Note
• https://github.com/tektoncd/pipeline/releases/tag/v1.11.1 · Note
• https://github.com/tektoncd/pipeline · Note
• https://twitter.com/pulsepatchio/status/2046785351000412375 · Twitter Post
• https://twitter.com/pulsepatchio/status/2047153476900155754 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048482505842471413 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ssjoms/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://twitter.com/CVEnew/status/2048481112490377238 · Twitter Post
• https://twitter.com/_cvereports/status/2049063836397801630 · Twitter Post