RHSA-2026:10026HighCVSS 9.6

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.4

Published
April 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (2)

CVE-2026-33022 →CVE-2026-33211 →

📋 Description

CVE-2026-33022 — github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names CVE-2026-33211 — Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver

🎯 Affected products105

  • Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:2dd31612709a260473298dd8dc5f0a7acd2ddb4cb904cdb4a78af45fc78f3636_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:3f18cbd40d453cb50e2c0012adf9d5310960038ea241aa0c2bd8a193455b9428_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:9c258ab15a9664319fb20c37a24f694f5399986dcdd5e273fe5600b00ce94425_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:f08e06d2264dc51181540cffc5a18d155bdce87167bee015188adde531b86129_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:04dfc5de0d8e8a431159ebcc2c4c311a9c546392ffb495ce21e41dfb7d5f2e16_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:2c2edaec3cd60796aea7c45ffeb74abe06d81c6c32c2bfdb868ed5752540f975_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:3f61b0a1d07d700a48f85ecbaf59d76521fb055a22733ccfebfca97c85825bed_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:c55963aca692a6168530a5d83e2c714551bb834e028ccef73244c0392693f3c6_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:65940b32600afe6daf2b3371904c1cfebd165a18258fb84acf1fc37399afdb5a_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:cacb1da0d7c69f4422ecedee7504bab7dc79dfe18ba30e28746a4b4f4bc05351_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:d76bd87bbe0ec9ce2e6ad006442b8fec270ac2d94ac044d150ff0c97d55b1689_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:ffc6719dffa2a204ad064029d2e891e8438c6345a32e421f41488f2ee9d02158_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:05efa0704e5927d7126a0bd97075716efce2b6fccfd803ee32deb626a5c91ed1_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:3c0a8d53e0f5209f06a99cee929e36ae868983e23e34341782e32fc2362427bd_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:c7b662322bb5137767ca6c7054960135f6eb2e1e58d2d97885b65e24c7fb9ecd_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:e099d31b04aec0af0f3f28bdcb989640d4ef4cf58e2ab136585f93ebce9ee3fa_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:766dfe16f97601fada3f433cb49ec0972dd2a8291f1916ac930055b973a280ff_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:8f076dc87af9322a285f6ce4b434f2cd073377e0ea4d15ba176ba1d4d61d4cc4_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:be84f6f723a5dccb3b25d7b51d7a2786827e37f33a9fcb24cb7e0e3cc67a3ee8_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:cba1d62b03607a828d8f183dd75b5a407bb79c8c52d9d82595523452ec377922_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:439b014810a91be2fdc5c108acd149321057bd2647eb862ba0975b15fb3d2ced_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:5e96c8968061cccbf10b7297dd4bf99a53c960c2d67366a8244c7fbe0c25a053_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:9295c272324ffe9c3d6378d0315e5d6c5e91ee64622935b26e232fffe07c4225_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:bd02c1fd188bbf3035d144d7f7af7efaf42ab852970e7940ec577092e47540de_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:27b85727eca0deb019c4097f666840476395db587806779396e016a86b59ac51_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:2ae1ad50f3f8eba2609774e7c98eab3d1791418e30e2fcf2483942d375cb0605_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:2f461c99cdcedaaf99b7313d0302ad20baab9fcae545d844ba59fc26618777a5_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:e5ea117b0598f46785107574fafc76ef0138751475b7d283551650b60626ad9f_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:1a0bcbd805892a9895d0143ee1c2c694e1e1f1eff3326a303deb5eaa6e5fbffc_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • +75 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, restrict the creation of ResolutionRequests to trusted users and service accounts. Implement strict Role-Based Access Control (RBAC) policies to limit which tenants can create TaskRuns or PipelineRuns that utilize the Tekton Pipelines git resolver. This reduces the exposure by preventing unauthorized access to the resolver pod's filesystem.

🔗 References (6)