RHSA-2026:26519HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2

Published
June 17, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (4)

CVE-2026-33186 →CVE-2026-33816 →CVE-2026-40938 →CVE-2026-27141 →

📋 Description

CVE-2026-27141 — golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-40938 — github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands

🎯 Affected products149

  • Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:3c4587b2b5dc7426cc24e8678dd103ed2b1abb8ca13f5ea5aab606d92e5e00ba_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:5330de373490f5bfd8fa40de3c8dfb21f64128dab695aaff3a6a4c96c3388d3b_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:c26593f4740103d3296bb094cf30af778128384617d0ac5b7ecef9987a88003a_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cache-rhel9@sha256:c728d376aafac1219d957bafe2f3ab75ae88e1d326d48ca409e209e09a782e6c_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:1cd66608b31afb07d5575714fd24becb2a3eb48fd6f897240986e5b5cd5ca25f_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:99aab6998dc6e4c8349a53e4ab52c0a9730aa75b36bb4e87d74bb6ee5f2044da_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:9d7a69223b0662bcf109a02007d017e5f10e5c563ff78c02d87af8d5d4ea24de_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:dd5328245120eb981cf5fe6153fc2d33ed9817612884bb7cf7fed77782cd1e20_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:0b3a5aa6d681f46fc242eefae9a3540b43c2be17b643d40ca4446cd0e8fc2abb_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:8627d0dd68402dc51137d89534c0bdb72e27fc3327be1e63e93a38ae72f653cd_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:a395182a2cda20322f0af7ecc972ab3bc9c07161e70174c2b4d9ac08f6aa9845_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:b289110701914022840061f5f5a931e5c895d16898fff3d78193b89c37943201_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-pf5-rhel9@sha256:51d8398c7057486fbc41a810031276ccd05179d43e9cf4369c8df440495c6ef7_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-pf5-rhel9@sha256:6aaf557a08c0952e2ec7463e3b3cef4d5f8fc9d24427a28c9766f6f0d12f08bd_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-pf5-rhel9@sha256:9f9b88b0fbc438aad06752a21fe76a870ba4d8042c6ee1ff0505af780ca8c2f0_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-pf5-rhel9@sha256:ff4f49f5218d296b3af828c17283f870aebd6d60813563b55908ffd4629eeab1_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:9e75f7392dcc9df58236d14c8c56e69b34564525b72862d851bea16367270128_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:9f80cfe35f04cbe6a16069c1ec1d8811be4d593e64e4c416f3c10d0867e6ae19_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:9fabbf4a7e28f6ab02f1ac77b82fc37e0e295f71b05fa9e56b1a5ee4056a0fed_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9@sha256:fdebb108386237b2ceb1a09abfd18a26fa724dfeb288b8db05a324c4534b109a_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:632a9d70719cce5d0fde98642ff48e6e810072173dd73db3792f6f80d5272fa7_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:838ee5faa3da19a38b8df19373dc4019f7b80ffdb71053e4f74d53a447a48eca_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:a1477ff3ddb9315e482647d228c09e55356d00291f9fde419d36e064b54fc6b8_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:e10748a721cdb9316cc4283549a800b7725268ba3e181945329c76350ab7b32d_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:34cde8028262bd635134993a4d95bbc63a38dc943862938955c2eda609a67f71_amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:3ef24dc7c5588180203520784ea3db6e1501e5190b3f59aa1f77df1a5bee9bfc_arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:82192c8ede01ce878231c9c56d7104d845e6bb69a8eeea17af84be7b56654eea_ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:d54076093c47f3d5576eb0a5c1e4cd7963a9d29f393a277721c8f34cb7efc263_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • registry.redhat.io/openshift-pipelines/pipelines-events-rhel9@sha256:04ddf503b9da7491acec12879894486790a2d2baf3256837ae5884eb73e91bce_s390x as a component of Red Hat OpenShift Pipelines 1.21
  • +119 more not shown

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (8)