Most recent entries from all

CLEANSTART-2026-BW27317 — Security fix for CVE-2026-40161 applied in: tekton-chains 0.25.2-r1, tekton-chains-fips 0.25.2-r1, tkn-fips 0.44.2-r0

2026-10-05T11:33:42.457534+00:00

Affected: CleanStart: tekton-chains, CleanStart: tekton-chains-fips, CleanStart: tkn-fips

CVE-2026-40161 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-319936

2026-10-05T11:33:42.457654+00:00

EUVD-2026-319936

fkie_cve-2026-40161

2026-10-05T11:33:42.457691+00:00

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

GHSA-wjxp-xrpv-xpff — Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

2026-10-05T11:33:42.457749+00:00

Affected: Go: github.com/tektoncd/pipeline

### Summary

The Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled `serverURL` when the user omits the `token` parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing `serverURL` to an attacker-controlled endpoint.

### Details

The git resolver's `ResolveAPIGit()` function in `pkg/resolution/resolver/git/resolver.go` constructs an SCM client using the user-supplied `serverURL` and a token obtained via `getAPIToken()`.

When the user provides `serverURL` but omits the `token` parameter:

1. `getSCMTypeAndServerURL()` reads `serverURL` directly from user params (`params[ServerURLParam]`) with no validation against the system-configured URL.

2. `secretRef` is set to `nil` because the user did not provide a token parameter.

3. `getAPIToken(ctx, nil, APISecretNameKey)` is called. It detects `apiSecret == nil`, creates a new `secretCacheKey`, and populates it from the system-configured secret (`conf.APISecretName` / `conf.APISecretNamespace` / `SYSTEM_NAMESPACE`).

4. `clientFunc(scmType, serverURL, string(apiToken))` creates an SCM client pointed at the attacker-controlled URL with the system token. The SCM factory sets the token as an `Authorization` header on the HTTP client.

5. All subsequent API calls (`Contents.Find`, `Git.FindCommit`) carry the system token to the attacker URL.

### Impact

The system Git API token (GitHub PAT…

RHSA-2026:24359 — Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.3

2026-10-05T11:33:42.457921+00:00

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands