CVE-2026-40161: Tekton Pipelines Information Disclosure

CVE-2026-40161 Overview

CVE-2026-40161 is a sensitive information exposure vulnerability affecting Tekton Pipelines, a popular Kubernetes-native CI/CD framework. The vulnerability exists in the Tekton Pipelines git resolver when operating in API mode. From versions 1.0.0 to 1.10.0, the git resolver sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. This allows a malicious tenant with TaskRun or PipelineRun create permission to exfiltrate shared API tokens (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint.

Critical Impact

Attackers can steal shared Git API tokens used across the Tekton Pipelines installation, potentially gaining unauthorized access to source code repositories and CI/CD pipelines across multiple projects.

Affected Products

• Tekton Pipelines versions 1.0.0 through 1.10.0
• Tekton Pipelines git resolver (API mode)
• Kubernetes environments running vulnerable Tekton Pipelines versions

Discovery Timeline

• 2026-04-21 - CVE-2026-40161 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40161

Vulnerability Analysis

This vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The flaw resides in the Tekton Pipelines git resolver component when configured to operate in API mode. The core issue is that when a user creates a TaskRun or PipelineRun resource and specifies a custom serverURL parameter without providing a corresponding token parameter, the git resolver defaults to using the system-configured Git API token.

This design flaw means that the centrally managed, shared API token intended for legitimate Git operations is inadvertently sent to whatever URL the user specifies. In a multi-tenant Kubernetes environment where Tekton Pipelines is shared across teams or projects, this creates a significant credential exposure risk.

Root Cause

The root cause of this vulnerability lies in the improper handling of authentication token parameters within the git resolver's API mode logic. When the token parameter is omitted in a user request, the system fails to validate whether the destination serverURL should be authorized to receive the system-configured credentials. Instead of rejecting requests with missing token parameters or restricting token usage to pre-approved server endpoints, the resolver automatically falls back to using the shared API token regardless of the destination URL.

Attack Vector

The attack vector is network-based and requires the attacker to have legitimate create permissions for TaskRun or PipelineRun resources within the Kubernetes cluster. The attack flow involves:

1. The attacker identifies a Tekton Pipelines installation using the git resolver in API mode
2. The attacker sets up an attacker-controlled HTTP server to capture incoming requests
3. The attacker creates a TaskRun or PipelineRun resource with a custom serverURL pointing to their malicious server
4. The attacker intentionally omits the token parameter from the request
5. The git resolver sends the system-configured Git API token to the attacker's server
6. The attacker captures and extracts the token (GitHub PAT, GitLab token, etc.)

The vulnerability can be exploited through malicious TaskRun or PipelineRun specifications. When the serverURL parameter is set to an attacker-controlled endpoint and the token parameter is omitted, the git resolver automatically sends the system-configured credentials to the specified URL. For detailed technical information, see the GitHub Security Advisory GHSA-wjxp-xrpv-xpff.

Detection Methods for CVE-2026-40161

Indicators of Compromise

• Unusual TaskRun or PipelineRun resources with custom serverURL parameters pointing to external or unknown endpoints
• Git resolver logs showing requests to non-standard Git API servers
• Network traffic from Tekton components to unexpected external IP addresses or domains
• Audit logs indicating creation of pipeline resources by users who shouldn't have Git resolver access

Detection Strategies

• Monitor Kubernetes audit logs for TaskRun and PipelineRun creation events with custom serverURL parameters
• Implement network policies to restrict egress traffic from Tekton resolver pods to approved Git API endpoints only
• Deploy SentinelOne Singularity for Cloud to detect anomalous API calls and credential exposure attempts
• Enable Tekton Pipelines audit logging and configure alerts for git resolver activity with external URLs

Monitoring Recommendations

• Configure alerting for any git resolver requests to URLs outside of approved Git hosting providers
• Implement network-level monitoring for unusual outbound connections from Kubernetes worker nodes running Tekton
• Review API token usage patterns and rotate credentials if suspicious activity is detected
• Enable detailed logging for the git resolver component to capture all serverURL and token parameter combinations

How to Mitigate CVE-2026-40161

Immediate Actions Required

• Upgrade Tekton Pipelines to a patched version beyond 1.10.0
• Audit existing TaskRun and PipelineRun resources for suspicious serverURL configurations
• Rotate all Git API tokens (GitHub PATs, GitLab tokens, etc.) that may have been exposed
• Implement network policies to restrict git resolver egress traffic to approved endpoints

Patch Information

Organizations should upgrade Tekton Pipelines to the latest patched version that addresses this vulnerability. Detailed patch information and upgrade guidance is available in the GitHub Security Advisory GHSA-wjxp-xrpv-xpff. Additional context can be found in GitHub Issue #9608 and GitHub Issue #9609.

Workarounds

• Disable the git resolver API mode until patches can be applied
• Implement Kubernetes admission controllers to validate and restrict serverURL parameters in TaskRun/PipelineRun specifications
• Apply network policies to limit egress from Tekton resolver pods to known Git API endpoints
• Restrict TaskRun and PipelineRun create permissions to only trusted users and service accounts

# Example NetworkPolicy to restrict git resolver egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-git-resolver-egress
  namespace: tekton-pipelines
spec:
  podSelector:
    matchLabels:
      app: tekton-pipelines-git-resolver
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 140.82.112.0/20  # GitHub API
    ports:
    - protocol: TCP
      port: 443