RHSA-2026:24484HighCVSS 9.6

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2

Published
June 8, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (5)

CVE-2026-40938 →CVE-2026-33186 →CVE-2026-33211 →CVE-2026-34986 →CVE-2026-40161 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33211 — Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40161 — github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL CVE-2026-40938 — github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands

🎯 Affected products9

  • Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@amd64 as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@amd64_darwin as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@amd64_windows as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@arm64 as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@arm64_darwin as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@arm64_windows as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@ppc64le as a component of Red Hat OpenShift Pipelines 1.21
  • serve-tkn-cli-1-21-serve-tkn-cli@s390x as a component of Red Hat OpenShift Pipelines 1.21

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this vulnerability, restrict the creation of ResolutionRequests to trusted users and service accounts. Implement strict Role-Based Access Control (RBAC) policies to limit which tenants can create TaskRuns or PipelineRuns that utilize the Tekton Pipelines git resolver. This reduces the exposure by preventing unauthorized access to the resolver pod's filesystem. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, ensure that the Git API token parameter is always explicitly provided when configuring Tekton Pipelines. Additionally, restrict permissions for creating TaskRun or PipelineRun resources to only trusted users to limit the attack surface. Review and enforce policies that prevent the use of user-controlled serverURLs without proper token authentication. Configuration changes may require a restart or reload of affected services to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)