Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-40938— Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

Quick assessment

Affected

tektoncd pipeline

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tekton Pipelines是Tekton开源的一个云原生管道。 Tekton Pipelines 1.0.0版本至1.11.0版本存在参数注入漏洞，该漏洞源于git解析器的revision参数直接作为位置参数传递给git fetch且未验证其不以-字符开头，可能导致攻击者注入任意git fetch标志，结合validateRepoURL函数明确允许以/开头的URL，能够提交ResolutionRequest对象的租户可链接这两种行为，在解析器pod上执行任意二进制文件。

CVSS 7.5 · High EPSS 0.79% · P56 Updated Sep 07, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1530 · Data from Cloud Storage

Affected Version Matrix 5

Vendor	Product	Version Range	Status
tektoncd	pipeline	`>= 1.0.0, < 1.0.2`	affected
		`>= 1.2.0, < 1.3.4`	affected
		`>= 1.4.0, < 1.6.2`	affected
		`>= 1.7.0, < 1.9.3`	affected
		`>= 1.10.0, < 1.11.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-40938

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

Source: CVE Program / CVE List V5

Vulnerability Description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

参数注入或修改

Source: CVE Program / CVE List V5

Vulnerability Title

Tekton Pipelines 参数注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tektoncd	pipeline	>= 1.0.0, < 1.0.2	-

II. Public POCs for CVE-2026-40938

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-40938

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-40938 (1)

🔗 Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE · Advisory · tektoncd/pipeline · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-40938 (1)

🔗 Release Tekton Pipeline release v1.11.1 "Javanese Jocasta" · tektoncd/pipeline · GitHub Read full article x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-40938

Same Patch Batch · tektoncd · 2026-04-21 · 5 CVEs total

CVE-2026-40161	7.7 HIGH	Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controll
CVE-2026-25542	6.5 MEDIUM	Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
CVE-2026-40924	6.5 MEDIUM	Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via
CVE-2026-40923	5.4 MEDIUM	Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekto

IV. Related Vulnerabilities

Same product: pipeline

Same vendor: tektoncd

Same weakness: CWE-88