Homepage

Directory Traversal The advisory has been revoked - it doesn't affect any version of package tekton-pipelines-1.9  (opens in a new tab)

Threat Intelligence

EPSS
0.58% (48th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-WOLFILATEST-TEKTONPIPELINES19-15725186
  • published21 Mar 2026
  • disclosed24 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 21 Mar 2026

CVE-2026-33211  (opens in a new tab)
CWE-22  (opens in a new tab)

Amendment

The Wolfi security team deemed this advisory irrelevant for Wolfi:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tekton-pipelines-1.9 package and not the tekton-pipelines-1.9 package as distributed by Wolfi.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests (e.g. by creating TaskRuns or PipelineRuns that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in resolutionrequest.status.data. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.

References