RHSA-2026:24359HighCVSS 8.5

Red Hat Security Advisory: Red Hat OpenShift Builds 1.7.3

Published
June 8, 2026
Last Modified
September 7, 2026

🔗 CVE IDs covered (3)

CVE-2026-40161 →CVE-2026-40938 →CVE-2026-32280 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-40161 — github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL CVE-2026-40938 — github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands

🎯 Affected products38

  • Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:18f00b5d62bd5526f80dbe2cb380e677c0f84953b762b3edb41d3e380e04eaf5_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:67f18db03a40270705bffb37c866250aa2418621f0b5128ebf34d9b7ab3df803_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:a286b64da40c2fefa4e4f67249e138409395168f03028d30a2f1cf765440974d_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:dfb8f5b7d5b2a4dbd83b6585d49f53b11c439bcd2d150144edba9fc08e0fe724_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:350e159561c341a69daf928466c64cf1936d4937af62a3a0378c7dfe65949365_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:6eaac6f9f219963aac92099fcf2ab0291d5c0c68cc9070c06c1d122531349802_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:92b94a5e69841aedd2ac577ab8a286ec4ded35ffabed478fdf9ab32fdf4fbb6f_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:cdf06172d9ecf62be5a86eef680a6a1e1198b75a6f14c8b9cc7d52c06076d44e_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:07a5fd537dd60ddc9a05766e2c8f4d7f407b2e7914cf0f60a83b4361e934e215_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:3b9bfd2d1f0c9917c65ba84cb26182522de4be3a6e34f4aa6a092c84c97518bc_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:a2485063e14fa8478f05f8a04c1fd43d402b38f8b5a24836ff389711f51f60f9_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9@sha256:bd6d2fed0ba96d6583b796370ce0949de210ead5505e60a33204a27b3c6cde2d_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:54a6a27410eabdbbeafd4137e74c1f9312bde27fa345ec4753693ed633668472_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:9bb9d6a35d2acbee9db6770e11894647b57c6c27d5a32944c21b26f382a4d6b5_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:ba720079d59c9b351c7b1ec156d5e3ebabeafcae862f5e86294f0563351f7b65_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:cc8bcc436c5e22a1a870599f673dc8cfca8a3d8970b620b8499ec78c207825bb_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:fcb0d4599ec7124f8185715d681d5f3e0d7a904f4544d107c5a8294de425a89f_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:351c74c3fd8d6c79909f8789d457a0e7695dc5a48da0329f0b903a8d76847d4f_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:5725324b6605bd242e64288df723c0c28dde50b10a1cec48fea7486d74b5782f_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:5a3ce7b8f6bb5b8e485c5efaadff958e4e356dd7e3c9fdbc608686e688703f17_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:c176b6a935420ca95e609241c03c3d4fc1beca73f1e8e3b6c45f7bb27c9c775e_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:503492d3bab8d86f320aca4850c732f7497655b3bb73d6e82031f8c5e592fec1_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:cbc806ef024057021397991e60becb5f19f85831d131ff7fe9cbdf967d15217c_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:d1733e18d64f81a3b24e145fcd7612e050faeb53e209018b1454d72d3d84c73b_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9@sha256:f4431461400983fa84667867de5ae0fd254e89c0924c5135440bfe49f53c2c5a_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:0436a253c41145169babd1378dfa9215748133fd2ab69d31bd0f173301476e1c_arm64 as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:a406fa897dfbf19b06a540ab504d774dcd6ab96a821e525771c04c894032ae49_s390x as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:dce347a369087dcc0584821af5924fa627d9f00bf3eba5fe8cf94d1dba404ff4_ppc64le as a component of Red Hat OpenShift Builds 1.7.3
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:e1da05467b3e168877435d5c5fff498844793476a4e93e9a0945ea07bd243475_amd64 as a component of Red Hat OpenShift Builds 1.7.3
  • +8 more not shown

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Builds 1.7.2 upgrade to 1.7.3 Workaround: To mitigate this issue, ensure that the Git API token parameter is always explicitly provided when configuring Tekton Pipelines. Additionally, restrict permissions for creating TaskRun or PipelineRun resources to only trusted users to limit the attack surface. Review and enforce policies that prevent the use of user-controlled serverURLs without proper token authentication. Configuration changes may require a restart or reload of affected services to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (7)