Описание
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
A flaw was found in Tekton Pipelines. A tenant with permissions to create TaskRun or PipelineRun resources can exploit this vulnerability. By omitting the Git API token parameter and pointing the serverURL to an attacker-controlled endpoint, the system-configured Git API token (such as a GitHub Personal Access Token or GitLab token) can be sent to the attacker. This information disclosure allows for the exfiltration of sensitive API tokens.
Отчет
This Moderate impact information disclosure flaw affects Tekton Pipelines. A user with permissions to create TaskRun or PipelineRun resources could exfiltrate the system-configured Git API token by directing the serverURL to an attacker-controlled endpoint and omitting the token parameter. This vulnerability doesn't affect a couple of Red Hat supported products as it's using a Pipelines version previously from 1.0.0, where the affected code is not present.
Меры по смягчению последствий
To mitigate this issue, ensure that the Git API token parameter is always explicitly provided when configuring Tekton Pipelines. Additionally, restrict permissions for creating TaskRun or PipelineRun resources to only trusted users to limit the attack surface. Review and enforce policies that prevent the use of user-controlled serverURLs without proper token authentication. Configuration changes may require a restart or reload of affected services to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-image-bundler-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed/openshift-mcp-server-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-chains-controller-rhel8 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-cli-tkn-rhel8 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-cli-tkn-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-controller-rhel8 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-controller-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-entrypoint-rhel8 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-entrypoint-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-events-rhel8 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.7 High
CVSS3
Связанные уязвимости
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
EPSS
7.7 High
CVSS3