# Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Tekton git resolver in API mode sends the system-configured Git API token to a user-supplied serverURL when the token param is omitted, letting a tenant exfiltrate the shared PAT.

- Payout: Research
- Severity: high
- Program: Tekton Pipelines
- Found by: kodareef5, stenzopolis1986-art, waveywaves
- Disclosed: 2026-04-21
- CVE: CVE-2026-40161
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wjxp-xrpv-xpff
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:go tech:kubernetes technique:source-review vuln:access-control vuln:info-disclosure vuln:secrets-leak

**Target:** Kubernetes git resolver (ResolveAPIGit) SCM client
**Root cause:** getSCMTypeAndServerURL() takes serverURL straight from user params without comparing it to the system-configured URL, and getAPIToken() falls back to the system secret whenever the user omits the token param, so the system token is attached to an attacker-chosen SCM endpoint.
**Steps:**
1. Tenant with TaskRun/PipelineRun create permission submits a resolver request with `serverURL` pointing at an attacker-controlled host and no `token` parameter.
2. `getSCMTypeAndServerURL()` reads `params[ServerURLParam]` with no validation against the system-configured URL.
3. `secretRef` is nil, so `getAPIToken(ctx, nil, APISecretNameKey)` sees `apiSecret == nil`, builds a new secretCacheKey and loads the system secret from `conf.APISecretName`/`conf.APISecretNamespace`/`SYSTEM_NAMESPACE`.
4. `clientFunc(scmType, serverURL, string(apiToken))` builds an SCM client pointed at the attacker URL with the system token set as an `Authorization` header.
5. Subsequent `Contents.Find` / `Git.FindCommit` calls deliver the token to the attacker endpoint.
**How found:** Code review of ResolveAPIGit() tracing how serverURL and the token fallback in getAPIToken() interact when the token param is absent; same threat model as prior advisory GHSA-j5q5-j9gm-2w5c (path traversal to SA token).
**Exploitation:** A namespace-scoped tenant creates a TaskRun/PipelineRun using the git resolver with a malicious serverURL and no token; the resolver pod authenticates to that URL with the system Git API token, which the attacker captures and reuses for read access to private repos, secrets and CI/CD configs.
**Insight:** In resolvers that merge user params with system-configured credentials, check the fallback path: any user-controlled endpoint field (serverURL, registry, host) combined with an omitted credential param can cause the system secret to be sent to the attacker's host.