RHSA-2026:17546HighCVSS 8.5

Red Hat Security Advisory: Red Hat OpenShift Builds 1.8.0

Published
May 14, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-40938 →

📋 Description

CVE-2026-40938 — github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands

🎯 Affected products38

  • Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:77414b7533c13515a757d2c74641d1ce80330aab8146fd4ea57f837a989507a6_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:c918825ce8fa23b002d7469ee2efbb86ee10461f05578bce92f4b7e869482247_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:d98cd490064b491c1113af559323718744b8ffc5e0ff59866618382f3b8dfb4f_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:f38e14bf78db8b645a3e80c9471d01d5adb4f6bc8d73e9444fed41f8e83a1766_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:4a5817f19afd6283e5aab8f654161f37e8ab750589d87adc4cf980391e2f4a15_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:52ab953841b19453f0e57842ee3341eadbb8b590224dc395e5c509e0d0931aff_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:89cfd055558b213ba418429aa77e88199cfd3f8855b40330682b720e6878bc20_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:b662ccd26b72796528890793a62b3e53cd9604e4da241dd2547abc8de3249f16_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:53ba1b9762390a2d770d02c6e338369e40b65f98386c8b2581d3281dae59640f_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:b22f8e3a951f48f9f4b6dd92a28092b5fa87df44e1120ac21bc6a23e0890f9fa_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:b40dd41d99d06f9ff1472316da8cdab0350427fc1c224699ae84bdd0af558b26_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:c295cee29b87190bd9b182445ded759c09d61348c8784333739e442b715d4d78_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:45d30010ea88f55261490bb7c96e2fa6436813117693a4bb4a505f91f997aae1_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:5848c62e2f1d9341b772c2fba1b9dfa982cf3855639e6ebc8a1125dc68b3c0de_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:6c65e9231f007f23364f433a37943c84a6d2cb325f2e61bea2080c787bd60fc9_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:b63c208036810de42e4bde48cfdf8b0ea663059e8fc3b8560a323664e512a0b1_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:b5e71156c80f4b61fde538d96d7142a2770a94f7bb51b53e6ba9f70e5b710022_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:131fc471ed9e63278ba3cba3c3717d10a91321707b5a5b99f567065a1853bdd2_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:89c9e3cc2b26af93e654ec385807775dff4e6f2900e41ac72fa76cb8a1e258a2_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:b4141b82dc4a149687f3f9d4125ea4dc5cbd0d53473de357c8009f4b89c362e3_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:cf39664e98cb24c06088b3046165c81d8c6dc07d5da77e19401879595f581ff4_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:0f2024194784ddef2d10755a1c04d3bc6ca18ddeba4cdd171ce6e47fed0d7892_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:1d2a091427e33a3e0c081c69a2cadf329e8a1fb618f69348328721acae6ec6b6_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:3d177aa899501feae044a5c1a306cd3257153d49a1276af5ae1b13c1cdb2b6df_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:8f41177b3bc405f921d26976d676f6077a8058d4083c980ab1631af90fc51f66_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:27094041cb5b14a0f368baf89fa8b0e0141665ec3c35f9f96c87fa8c3975c9a1_ppc64le as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:397257c4af010f9a7db625496126aadbd7d93b2547b3c1b7e76e68e8997ffd76_amd64 as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:d91312e9b8d72a52f23badc6f37ea2d8d3563f0539810ad8e7b743b4821034f2_s390x as a component of Red Hat OpenShift Builds 1.8.1
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:fd079d2ad390e30cd020511fb5ae2a84d1aee8d832abc365406c990e0550c562_arm64 as a component of Red Hat OpenShift Builds 1.8.1
  • +8 more not shown

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Builds 1.7.z upgrade to 1.8.0 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (5)