جزئیات آسیب‌پذیری
CVE-2026-40938
Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
شرح رسمی (انگلیسی)
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 8.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.0.0, < 1.0.2 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.10.0, < 1.11.1 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.2.0, < 1.3.4 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.4.0, < 1.6.2 | CVEProject cvelistV5 (CNA) |
| tektoncd | pipeline | >= 1.7.0, < 1.9.3 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۰- https://github.com/tektoncd/pipeline/releases/tag/v1.11.1 x_refsource_MISC
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-40938 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2460292 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40938.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24359 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17546 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26538 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26519 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24484 vendor-advisoryx_refsource_REDHAT
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۲/۰۲
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')