PT-2026-34008

CVE-2026-40161

·

Published

2026-04-21

·

Updated

2026-09-18

Description by

CVSS 3.1
7.7
High
MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 1.0.0 through 1.10.0
Description The git resolver in API mode sends the system-configured Git API token to a user-controlled 'serverURL' when the token parameter is omitted. A tenant with TaskRun or PipelineRun create permissions can exfiltrate shared API tokens, such as GitHub PAT or GitLab tokens, by directing 'serverURL' to an attacker-controlled endpoint.
Recommendations Update Tekton Pipelines to a version later than 1.10.0.
Exploitability
Exploit
Fix
Vendors
Affected products
Weakness enumeration
CWE-201: Insertion of Sensitive Information Into Sent Data
Related identifiers
CVE-2026-40161
GHSA-WJXP-XRPV-XPFF
CLEANSTART-2026-BW27317
GO-2026-5711
OPENSUSE-SU-2026:21483-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com