جزئیات آسیب‌پذیری
CVE-2026-33211
Red Hat OpenShift PipelinesRed Hat OpenShift Serverlesstektoncd pipeline
Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
CVSS 3.1
9.6بحرانی
شرح رسمی (انگلیسی)
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.6بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| 9.6بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.0.0, < 1.0.1 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.1.0, < 1.3.3 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.10.0, < 1.10.2 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.4.0, < 1.6.1 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.7.0, < 1.9.2 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۲۱- https://github.com/tektoncd/pipeline/security/advisories/GHSA-j5q5-j9gm-2w5c x_refsource_CONFIRM
- https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c x_refsource_MISC
- https://github.com/tektoncd/pipeline/commit/318006c4e3a5 x_refsource_MISC
- https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd x_refsource_MISC
- https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae x_refsource_MISC
- https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e x_refsource_MISC
- https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db x_refsource_MISC
- https://github.com/tektoncd/pipeline/commit/ec7755031a183b345cf9e64bea0e0505c1b9cb78 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-33211 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2450554 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33211.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:10155 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10158 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6170 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6166 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24484 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10066 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21932 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21931 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10026 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10125 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۱/۰۴
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۵۸٪
احتمال بهره‌برداری در ۳۰ روز
۴۸٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')