RHSA-2026:26538

Vulnerability from csaf_redhat - Published: 2026-06-17 09:07 - Updated: 2026-06-17 20:23
Summary
Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2
Severity
Important
Notes
Topic: The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).
Details: The 1.21.2 release of Red Hat OpenShift Pipelines Operator.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-27141

A flaw was found in golang.org/x/net/http2. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames, which are data packets used in the HTTP/2 protocol. Due to a missing check for null values, processing these specific frames (types 0x0a through 0x0f) can cause the server to crash. This leads to a Denial of Service (DoS) condition, making the affected server unavailable to legitimate users.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-40938

A flaw was found in Tekton Pipelines, a system for declaring continuous integration/continuous delivery (CI/CD) pipelines. An authenticated user, able to submit `ResolutionRequest` objects, can exploit a vulnerability by injecting malicious commands into the git resolver's revision parameter. This allows for the execution of unauthorized programs on the resolver pod. Successful exploitation can lead to the exfiltration of all cluster-wide secrets, resulting in significant information disclosure.

8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64 —
Vendor Fix fix
Workaround
Threats
Impact Important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator..\nFor more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The 1.21.2 release of Red Hat OpenShift Pipelines Operator.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:26538",
        "url": "https://access.redhat.com/errata/RHSA-2026:26538"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27141",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27141"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40938",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40938"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines",
        "url": "https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26538.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2",
    "tracking": {
      "current_release_date": "2026-06-17T20:23:24+00:00",
      "generator": {
        "date": "2026-06-17T20:23:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.0.0"
        }
      },
      "id": "RHSA-2026:26538",
      "initial_release_date": "2026-06-17T09:07:54+00:00",
      "revision_history": [
        {
          "date": "2026-06-17T09:07:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-17T09:08:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-17T20:23:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Pipelines 1.21",
                "product": {
                  "name": "Red Hat OpenShift Pipelines 1.21",
                  "product_id": "Red Hat OpenShift Pipelines 1.21",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_pipelines:1.21::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Pipelines"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64",
                  "product_id": "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/pipelines-operator-bundle@sha256%3A37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63?arch=amd64\u0026repository_url=registry.redhat.io/openshift-pipelines/pipelines-operator-bundle\u0026tag=1781686494"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64 as a component of Red Hat OpenShift Pipelines 1.21",
          "product_id": "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Pipelines 1.21"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27141",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-02-26T20:09:11.626155+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443104"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/http2. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames, which are data packets used in the HTTP/2 protocol. Due to a missing check for null values, processing these specific frames (types 0x0a through 0x0f) can cause the server to crash. This leads to a Denial of Service (DoS) condition, making the affected server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443104",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443104"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/746180",
          "url": "https://go.dev/cl/746180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77652",
          "url": "https://go.dev/issue/77652"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4559",
          "url": "https://pkg.go.dev/vuln/GO-2026-4559"
        }
      ],
      "release_date": "2026-02-26T18:50:31.830000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-17T09:07:54+00:00",
          "details": "Red Hat OpenShift Pipelines is a cloud-native, continuous integration and\ncontinuous delivery (CI/CD) solution based on Kubernetes resources.\nIt uses Tekton building blocks to automate deployments across multiple\nplatforms by abstracting away the underlying implementation details.\nTekton introduces a number of standard custom resource definitions (CRDs)\nfor defining CI/CD pipelines that are portable across Kubernetes distributions.",
          "product_ids": [
            "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:26538"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames"
    },
    {
      "cve": "CVE-2026-40938",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-04-21T21:02:16.557479+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460292"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Tekton Pipelines, a system for declaring continuous integration/continuous delivery (CI/CD) pipelines. An authenticated user, able to submit `ResolutionRequest` objects, can exploit a vulnerability by injecting malicious commands into the git resolver\u0027s revision parameter. This allows for the execution of unauthorized programs on the resolver pod. Successful exploitation can lead to the exfiltration of all cluster-wide secrets, resulting in significant information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Tekton Pipelines allows an authenticated user to achieve arbitrary code execution on the resolver pod by injecting malicious commands into the git resolver\u0027s revision parameter. This vulnerability happens because the `revision` parameter is passed as a positional argument to the `git fetch` command without any previous validation whether the parameter\u0027s value doesn\u0027t start with `-` character. Combining this lack of validation with the fact the function which validates the repository URL explicitly allows a repository URL to being with `/`, translating to a local filesystem. An attacker with enough privileges to perform an operation which trigger resolvers to use the `ResolutionRequest` function can \nchain both behaviors to trick Tekton Pipelines to load and execute an arbitrary binary on the resolver pod.\n\nExploring this vulnerability may be considered of a high complexity as an attacker needs to either know an existing valid git repository located at a predicable path already in the resolver pod or a default URL configuration pointing to a local filesystem\u0027s path.\n \nA successful exploitation of the flaw can lead to the exfiltration of all cluster-wide secrets, posing a significant risk to the integrity and confidentiality of the OpenShift environment. Additionally, depending on the data included in the `kubeconfig` files, an attacker may achieve privilege escalation or perform lateral movements within the targeted cluster.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40938"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460292",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460292"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40938",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40938"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40938",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40938"
        },
        {
          "category": "external",
          "summary": "https://github.com/tektoncd/pipeline/releases/tag/v1.11.1",
          "url": "https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq",
          "url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq"
        }
      ],
      "release_date": "2026-04-21T20:45:24.658000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-17T09:07:54+00:00",
          "details": "Red Hat OpenShift Pipelines is a cloud-native, continuous integration and\ncontinuous delivery (CI/CD) solution based on Kubernetes resources.\nIt uses Tekton building blocks to automate deployments across multiple\nplatforms by abstracting away the underlying implementation details.\nTekton introduces a number of standard custom resource definitions (CRDs)\nfor defining CI/CD pipelines that are portable across Kubernetes distributions.",
          "product_ids": [
            "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:26538"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Pipelines 1.21:registry.redhat.io/openshift-pipelines/pipelines-operator-bundle@sha256:37f76414fb74a87e6aaa715e8a645fb9c4a5d383c9c232fc0a468760bafe0d63_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.