> CVE-2026-40938 [HIGH]

« BACK_TO_HOME
PUBLISHED
2026-04-21 21:16
MODIFIED
2026-04-21 21:16
CVSS_SCORE V3
7.5
EPSS (Prob. Exploit)
0.90%
Top 40.5%
DATA SOURCES:
NVD 🔗 2026-04-21 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05

> DESCRIPTION

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 1.0.0 to before 1.11.0, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. This vulnerability is fixed in 1.11.1.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EXPLOITABILITY
1.6
IMPACT
5.9

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
High (H)
Conditions spécifiques doivent être réunies pour exploiter
PR (Privilèges Requis)
Privileges Required
Low (L)
Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
High (H)
Divulgation totale d'informations
I (Impact Intégrité)
Integrity Impact
High (H)
Modification totale des données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
High
Divulgation totale d'informations
Intégrité
High
Modification totale des données possible
Disponibilité
High
Interruption totale du service possible

> WEAKNESSES

CWE-88

> CWE DETAILED DESCRIPTIONS

CWE-88: Improper Neutralization of Argument Delimiters in a Command - The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat OpenShift Builds 1.8.0
Red Hat OpenShift Builds 1.8.0
Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.3
Red Hat OpenShift Builds 1.7.3
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2
The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2
The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2
The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2
Red Hat OpenShift Builds 1.9.2
Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2
Red Hat OpenShift Builds 1.9.2

> GITHUB SECURITY ADVISORY

GHSA-94jr-7pqp-xhcq HIGH

Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

AFFECTED PACKAGES:
GO / github.com/tektoncd/pipeline
>= 1.0.0, < 1.0.2
Fixed in: 1.0.2
GO / github.com/tektoncd/pipeline
>= 1.2.0, < 1.3.4
Fixed in: 1.3.4
GO / github.com/tektoncd/pipeline
>= 1.4.0, < 1.6.2
Fixed in: 1.6.2
GO / github.com/tektoncd/pipeline
>= 1.7.0, < 1.9.3
Fixed in: 1.9.3
GO / github.com/tektoncd/pipeline
>= 1.10.0, < 1.11.1
Fixed in: 1.11.1

> HISTORIQUE DES MODIFICATIONS

Première apparition
21/04/2026 21:16
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - The product constructs a string for a command to be executed by a separate component in another control sph...
Nouvelle valeur:
CWE-88: Improper Neutralization of Argument Delimiters in a Command - The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not pr...
📊 ENRICHISSEMENT 01/05/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - The product constructs a string for a command to be executed by a separate component in another control sph...
Total des modifications: 2 Dernière mise à jour: 1 week ago

> REFERENCES

https://github.com/tektoncd/pipeline/releases/tag/v1.11.1
https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq
« BACK_TO_HOME