A critical information disclosure vulnerability in Tekton Pipelines allows authenticated users to exfiltrate sensitive Git credentials by manipulating the git resolver configuration.

The git resolver in API mode improperly transmits the system-configured Git API token to a user-controlled serverURL when the token parameter is omitted. This flaw requires the attacker to have TaskRun or PipelineRun create permissions to trigger the exfiltration.

Successful exploitation allows an authenticated user to steal critical system credentials, such as GitHub PATs or GitLab tokens, used for CI/CD operations. Given the CVSS score of 7.7, this represents a high risk as it facilitates unauthorized access to source code repositories and downstream deployment environments. This could lead to significant data breaches, supply chain compromise, and reputational damage.

Immediate Action: Update Tekton Pipeline to version 1.0.2, 1.3.4, 1.6.2, 1.9.3, or 1.11.1 as appropriate for your specific deployment branch.

Proactive Monitoring: Review CI/CD pipeline access logs for suspicious TaskRun or PipelineRun configurations that point to unknown or external URLs.

Compensating Controls: Restrict permissions for creating TaskRuns and PipelineRuns to trusted users only and implement network egress filtering to prevent unauthorized connections to external endpoints from the cluster.

Public Exploit Available: Unknown

This vulnerability presents a clear and actionable risk to the integrity of CI/CD environments. Organizations utilizing Tekton Pipelines should prioritize the application of the provided patches to prevent the potential exfiltration of highly privileged Git credentials. Failure to remediate allows any user with basic pipeline creation permissions to gain unauthorized access to protected version control systems.