CVE-2026-40161 tektoncd CVE debrief

Who should care

Tekton cluster operators, platform/security teams running multi-tenant CI/CD, and any environment that lets untrusted users create TaskRun or PipelineRun objects while using a shared Git API token.

Technical summary

In API mode, Tekton Pipelines' git resolver can forward the system-configured Git API token to the serverURL supplied by the user when the token parameter is omitted. That creates a confidentiality issue because a user with TaskRun or PipelineRun create permission can point the resolver at an attacker-controlled endpoint and capture the shared Git credential. NVD metadata classifies the issue as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N and references CWE-201.

Defensive priority

High; prioritize immediately in any shared or multi-tenant Tekton deployment, especially where Git API tokens are centrally configured and tenants can create runs.

Recommended defensive actions

• Upgrade Tekton Pipelines to a fixed release matching your branch: 1.0.2, 1.3.4, 1.6.2, 1.9.3, or 1.11.1.
• Review any pipeline or task definitions that use the git resolver in API mode and ensure token handling is explicit and consistent with the fixed release behavior.
• Restrict who can create TaskRun and PipelineRun resources, especially in shared clusters or namespaces.
• Audit for shared Git API tokens and rotate them if you suspect they may have been exposed.
• Check resolver and admission controls for user-supplied serverURL values, and apply additional policy or egress restrictions where appropriate.

Evidence notes

The supplied vendor advisory text says the issue exists starting in 1.0.0 and before 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1. NVD metadata for the same CVE references GitHub issue tracking and the vendor advisory, and its CPE criteria list Tekton Pipelines as vulnerable from 1.0.0 through 1.10.0; use the vendor advisory's branch-specific fix versions when planning upgrades. NVD also records the weakness as CWE-201 and a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Official resources