CVE-2026-40938 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-40938HIGH

tektoncd pipeline — Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  C  H  H  H    8.5   .0079   53.4     —

AFFECTED
  Product   Versions             Fixed
  pipeline  >= 1.0.0, < 1.0.2 –  —

TIMELINE
  Apr 15  Reserved by GitHub_M
  Apr 21  Published (CNA: GitHub_M)
  Aug 17  EXPLOIT PUBLISHED — CVE-2026-40938 (tektoncd pipeline). Public exploit reference added.
  Aug 17  RESCORED — CVE-2026-40938 (tektoncd pipeline). CVSS 7.5 → 8.5 (NVD).

CWE-88 · CNA: GitHub_M · CVSS v3.1 · 10 references · NVD status: Modified

Description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
April 15, 2026	Reserved	Reserved by GitHub_M
April 21, 2026	Published	Published (CNA: GitHub_M)
August 17, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-40938 (tektoncd pipeline). Public exploit reference added.
August 17, 2026	RESCORED	RESCORED — CVE-2026-40938 (tektoncd pipeline). CVSS 7.5 → 8.5 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
tektoncd	pipeline	—	>= 1.0.0, < 1.0.2	—

Weaknesses

CWE-88

References (10)

https://access.redhat.com/errata/RHSA-2026:17546 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:24359 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:24484 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:26519 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:26538 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/security/cve/CVE-2026-40938 [vdb-entry, x_refsource_REDHAT]
https://bugzilla.redhat.com/show_bug.cgi?id=2460292 [issue-tracking, x_refsource_REDHAT]
https://github.com/tektoncd/pipeline/releases/tag/v1.11.1 [x_refsource_MISC]
https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq [x_refsource_CONFIRM]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40938.json [x_sadp-csaf-vex]

Authoritative record: CVE-2026-40938 at cve.org

Vendors: tektoncd

Weaknesses: CWE-88

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-40938 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.