Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-33211 critical CVSS 9.6

Path Traversal in github.com/tektoncd/pipeline (CVE-2026-33211)

Summary

Path traversal in github.com/tektoncd/pipeline (CVE-2026-33211). Confidential information can be exposed externally. Mitigation: upgrade to 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.11.1 or later.

Original description

The description as published by the source.

Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A weakness called CVE-2026-33211 was discovered in github.com/tektoncd/pipeline.
In plain terms, it is a flaw that lets attackers reach files they should not see.
Severity is Critical (CVSS 9.6/10). If exploited, attackers can fully take over the affected system.
What you should do: update the affected software to the latest version. If unsure, ask your IT team or search the vendor's site for "github.com/tektoncd/pipeline CVE-2026-33211".

CVE-2026-33211 (github.com/tektoncd/pipeline). Severity: Critical / CVSSv3 9.6. Category: CWE-22.
Response plan:

  1. Check the vendor advisory for affected versions and the patched release.
  2. If a vulnerable version is running in production, schedule maintenance (urgency from KEV/CVSS).
  3. If no patch yet, mitigate via WAF rule, disabling the affected feature, etc.
  4. Monitor logs / SIEM for known IOC and PoC signatures of this CVE.
    PoCs and fix commits: see the 'References' section, MITRE, and NVD.
❓ What is the problem

A weakness (CVE-2026-33211) in github.com/tektoncd/pipeline. In plain words, it is a flaw that lets attackers reach files they should not see.

📍 Affected scope

Target versions of github.com/tektoncd/pipeline (see vendor advisory). If running in production, identify exposure immediately.

🔥 Severity

Severity: Critical (CVSS 9.6/10). If exploited, attackers can fully take over the affected system.

🔧 How to fix

Update to the patched release as listed in the vendor advisory. (Typical mitigation pattern for CWE-22)

🛡️ Workaround

If a patch is not yet available, consider disabling the affected feature, applying WAF rules, blocking via network ACLs, or isolating the vulnerable version.

🔍 Detection

Check version information, scan dependencies via SBOM, and monitor SIEM for IOC and PoC signatures related to this CVE.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'Linuxfoundation' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で Linuxfoundation を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Go github.com/tektoncd/pipeline
[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"},{"introduced":"1.1.0"},{"fixed":"1.3.3"},{"introduced":"1.4.0"},{"fixed":"1.6.1"},{"introduced":"1.7.0"},{"fixed":"1.9.2"},{"introduced":"1.10.0"},{"fixed":"1.11.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details