{"id":"CVE-2026-40161","title":"github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL (CVE-2026-40161)","summary":"A flaw was found in Tekton Pipelines. A tenant with permissions to create TaskRun or PipelineRun resources can exploit this vulnerability. By omitting the Git API token parameter and pointing the serverURL to an attacker-controlled endpoin…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-918","vendor":"Red Hat","product":"Red Hat OpenShift Builds 1.7.3","affected":["builds_for_red_hat_openshift","openshift_pipelines","openshift_virtualization 4","openshift_builds 1.7.3","openshift_builds 1.9.2","openshift_pipelines 1.21"],"patched":["openshift_builds 1.7.3","openshift_builds 1.9.2","openshift_pipelines 1.21"],"published":"2026-04-21","updated":"2026-10-25","sourceUpdated":"2026-10-25T06:59:33+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40161.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40161.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-40161"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460173"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40161"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40161"},{"url":"https://github.com/tektoncd/pipeline/issues/9608"},{"url":"https://github.com/tektoncd/pipeline/issues/9609"},{"url":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-wjxp-xrpv-xpff"},{"url":"https://access.redhat.com/errata/RHSA-2026:24359"},{"url":"https://access.redhat.com/errata/RHSA-2026:89041"},{"url":"https://access.redhat.com/errata/RHSA-2026:89131"},{"url":"https://access.redhat.com/errata/RHSA-2026:24484"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.0026,"epssPercentile":0.17854,"aliases":["GO-2026-5711","GHSA-wjxp-xrpv-xpff"],"ecosystem":"go","ingestedAt":"2026-07-24T19:07:03.372Z","slug":"CVE-2026-40161","body":"## Overview\n\nA flaw was found in Tekton Pipelines. A tenant with permissions to create TaskRun or PipelineRun resources can exploit this vulnerability. By omitting the Git API token parameter and pointing the serverURL to an attacker-controlled endpoint, the system-configured Git API token (such as a GitHub Personal Access Token or GitLab token) can be sent to the attacker. This information disclosure allows for the exfiltration of sensitive API tokens.\n\n## Vendor advisories\n\n- **RHSA-2026:24359** · Red Hat · fixed in: Red Hat OpenShift Builds 1.7.3 · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24359)\n- **RHSA-2026:89041** · Red Hat · fixed in: Red Hat OpenShift Builds 1.9.2 · released 2026-10-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:89041)\n- **RHSA-2026:89131** · Red Hat · fixed in: Red Hat OpenShift Builds 1.9.2 · released 2026-10-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:89131)\n- **RHSA-2026:24484** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.21 · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24484)\n- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, Red Hat OpenShift Virtualization 4 · no fix planned: Red Hat OpenShift Virtualization 4, Builds for Red Hat OpenShift, OpenShift Pipelines · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40161.json)\n\n**github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL** — rated Moderate by Red Hat. Released 2026-04-21, updated 2026-10-25.\n\nAffected:\n\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- Red Hat OpenShift Virtualization 4\n\nFixed:\n\n- Red Hat OpenShift Builds 1.7.3\n- Red Hat OpenShift Builds 1.9.2\n- Red Hat OpenShift Pipelines 1.21\n\nNo fix planned:\n\n- Red Hat OpenShift Virtualization 4\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n\nNot affected:\n\n- Red Hat OpenShift Builds 1.7.3\n- Red Hat OpenShift Builds 1.9.2\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Artifact Signer\n\n## Remediation\n\nIt is recommended that existing users of Red Hat OpenShift Builds 1.7.2 upgrade to 1.7.3 https://access.redhat.com/errata/RHSA-2026:24359\nIt is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 https://access.redhat.com/errata/RHSA-2026:89041\nIt is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 https://access.redhat.com/errata/RHSA-2026:89131\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, ensure that the Git API token parameter is always explicitly provided when configuring Tekton Pipelines. Additionally, restrict permissions for creating TaskRun or PipelineRun resources to only trusted users to limit the attack surface. Review and enforce policies that prevent the use of user-controlled serverURLs without proper token authentication. Configuration changes may require a restart or reload of affected services to take effect.\n\n## Package advisory (CVE-2026-40161)\n\nAffected packages:\n\n- `github.com/tektoncd/pipeline >= 1.10.0, < 1.11.1`\n\nPatched in:\n\n- `github.com/tektoncd/pipeline 1.11.1`\n\nSource: https://osv.dev/vulnerability/GO-2026-5711","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":229498,"id":"CVE-2026-40161","ts":1793019814924,"field":"cvss","old":null,"new":"7.7"},{"seq":229497,"id":"CVE-2026-40161","ts":1793019814924,"field":"severity","old":"none","new":"high"}]}