Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, …

A path traversal vulnerability exists in Tekton Pipelines git resolver starting from version 1.0.0. The vulnerability allows tenants with ResolutionRequests permissions to read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens, through the pathInRepo parameter. File contents are returned base64-encoded in resolutionrequest.status.data. Multiple versions are affected including 1.0.0 through 1.10.1. Patches are available in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2.