# Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

Tekton git resolver's unvalidated pathInRepo parameter allows path traversal to read arbitrary files, including the resolver pod's ServiceAccount token, enabling cluster-wide secret access.

- Payout: Research
- Severity: critical
- Program: Tekton Pipelines
- Found by: 1seal, KoreaSecurity
- Disclosed: 2026-03-18
- CVE: CVE-2026-33211
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-j5q5-j9gm-2w5c
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-j5q5-j9gm-2w5c
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:ghsa sev:critical tech:go tech:kubernetes technique:source-review vuln:info-disclosure vuln:path-traversal

**Target:** git resolver in Tekton Pipelines resolver pod (Kubernetes)
**Root cause:** getFileContent() joins the clone directory with user-supplied pathInRepo via filepath.Join and calls os.ReadFile without validating for '..' traversal, after a refactor switched from go-git's in-memory FS to the real filesystem.
**Steps:**
1. Create a TaskRun/PipelineRun using the git resolver with a pathInRepo value like `../../../../etc/passwd`
2. Resolver clones repo then calls `os.ReadFile(filepath.Join(repo.directory, path))` with the traversal path
3. Read base64-encoded file contents from `resolutionrequest.status.data`
4. Target `/var/run/secrets/kubernetes.io/serviceaccount/token` to exfiltrate the resolver pod's SA token
**How found:** Reporter traced the refactor commit 318006c4e3a5 that replaced go-git's in-memory filesystem (unescapable) with shelling out to git and os.ReadFile on the real filesystem, then noted pathInRepo was unvalidated.
**Exploitation:** Namespace-scoped tenant creates a ResolutionRequest via TaskRun/PipelineRun with a traversal pathInRepo; resolver returns arbitrary file contents base64-encoded in status.data. Attacker reads the resolver pod's SA token, which in default RBAC has get/list/watch on secrets cluster-wide, escalating to cluster-wide secret read.
**Escalation:** Exfiltrated tekton-pipelines-resolvers SA token grants cluster-wide secrets get/list/watch, pivoting namespace-scoped access to cluster-wide credential theft.
**Insight:** When a project swaps a sandboxed/in-memory filesystem for real OS file APIs, re-audit every user-controlled path join — the containment guarantee silently disappears. Also check what the resolver/controller pod's SA can reach, since file read becomes credential theft.