CVE-2026-33211
2 advisories.
Go/github.com/tektoncd/pipeline CVE-2026-33211: critical 9.6
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
Action: Upgrade github.com/tektoncd/pipeline to 1.0.1 or later.
go get github.com/tektoncd/pipeline@v1.0.1go get github.com/tektoncd/pipeline@v1.3.3go get github.com/tektoncd/pipeline@v1.6.1go get github.com/tektoncd/pipeline@v1.9.2go get github.com/tektoncd/pipeline@v1.10.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.0.1 | - |
| 1.1.0 | 1.3.3 | - |
| 1.4.0 | 1.6.1 | - |
| 1.7.0 | 1.9.2 | - |
| 1.10.0 | 1.10.2 | - |
Fixed versions
| 1.0.1 | 1.3.3 | 1.6.1 | 1.9.2 | 1.10.2 |
Sources
- osv: GHSA-j5q5-j9gm-2w5c
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-j5q5-j9gm-2w5c
- https://nvd.nist.gov/vuln/detail/CVE-2026-33211
- https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c
- https://github.com/tektoncd/pipeline/commit/318006c4e3a5
- https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd
- https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae
- https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e
- https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db
- https://github.com/tektoncd/pipeline/commit/ec7755031a183b345cf9e64bea0e0505c1b9cb78
- https://github.com/tektoncd/pipeline
CVE-2026-33211 · published · modified · JSON
Go/github.com/tektoncd/pipeline CVE-2026-33211: unknown
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline
Action: Upgrade github.com/tektoncd/pipeline to 1.0.1 or later.
go get github.com/tektoncd/pipeline@v1.0.1go get github.com/tektoncd/pipeline@v1.3.3go get github.com/tektoncd/pipeline@v1.6.1go get github.com/tektoncd/pipeline@v1.9.2go get github.com/tektoncd/pipeline@v1.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.0.1 | - |
| 1.1.0 | 1.3.3 | - |
| 1.4.0 | 1.6.1 | - |
| 1.7.0 | 1.9.2 | - |
| 1.10.0 | 1.11.1 | - |
Fixed versions
| 1.0.1 | 1.3.3 | 1.6.1 | 1.9.2 | 1.11.1 |
Sources
CVE-2026-33211 · published · modified · JSON