Описание
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
Summary
A validation bypass in the VolumeMount path restriction allows mounting
volumes under restricted /tekton/ internal paths by using .. path
traversal components. The restriction check uses strings.HasPrefix
without filepath.Clean, so a path like /tekton/home/../results
passes validation but resolves to /tekton/results at runtime.
Details
Tekton Pipelines restricts VolumeMount paths under /tekton/ (except
/tekton/home) to prevent users from interfering with internal
execution state. The validation at
pkg/apis/pipeline/v1/container_validation.go checks mount paths using
strings.HasPrefix without normalizing the path first:
Because /tekton/home is an allowed prefix, a path like
/tekton/home/../results passes both checks. At runtime, the container
runtime resolves .. and the actual mount point becomes
/tekton/results.
The same pattern exists in pkg/apis/pipeline/v1beta1/task_validation.go.
Impact
An authenticated user with Task or TaskRun creation permissions can mount volumes over internal Tekton paths, potentially:
- Writing fake task results that downstream pipelines trust
- Reading or modifying step scripts before execution
- Interfering with entrypoint coordination state
Patches
(to be filled: fixed in versions X.Y.Z)
Workarounds
- Use admission controllers (OPA/Gatekeeper, Kyverno) to validate that
VolumeMount paths do not contain
..components. - In multi-tenant setups, restrict who can create Task and TaskRun resources via RBAC.
Affected Versions
All versions through v1.10.0 (both v1 and v1beta1 APIs).
Acknowledgments
This vulnerability was reported by @kodareef5.
Пакеты
github.com/tektoncd/pipeline
>= 1.10.0, < 1.11.1
1.11.1
github.com/tektoncd/pipeline
>= 1.7.0, < 1.9.3
1.9.3
github.com/tektoncd/pipeline
>= 1.4.0, < 1.6.2
1.6.2
github.com/tektoncd/pipeline
>= 1.2.0, < 1.3.4
1.3.4
github.com/tektoncd/pipeline
>= 1.0.0, < 1.0.2
1.0.2
Связанные уязвимости
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.