GitHub Security Advisory: GHSA-wjxp-xrpv-xpff
Package: github.com/tektoncd/pipeline (GO)
Severity: HIGH (CVSS 7.7)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: >= 1.0.0, <= 1.10.0
Patched in: unpatched

Summary: Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Details:
### Summary

The Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled `serverURL` when the user omits the `token` parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing `serverURL` to an attacker-controlled endpoint.

### Details

The git resolver's `ResolveAPIGit()` function in `pkg/resolution/resolver/git/resolver.go` constructs an SCM client using the user-supplied `serverURL` and a token obtained via `getAPIToken()`.

When the user provides `serverURL` but omits the `token` parameter:

1. `getSCMTypeAndServerURL()` reads `serverURL` directly from user params (`params[ServerURLParam]`) with no validation against the system-configured URL.

2. `secretRef` is set to `nil` because the user did not provide a token parameter.

3. `getAPIToken(ctx, nil, APISecretNameKey)` is called. It detects `apiSecret == nil`, creates a new `secretCacheKey`, and populates it from the system-configured secret (`conf.APISecretName` / `conf.APISecretNamespace` / `SYSTEM_NAMESPACE`).

4. `clientFunc(scmType, serverURL, string(apiToken))` creates an SCM client pointed at the attacker-controlled URL with the system token. The SCM factory sets the token as an `Authorization` header on the HTTP client.

5. All subsequent API calls (`Contents.Find`, `Git.FindCommit`) carry the system token to the attacker URL.

### Impact

The system Git API token (GitHub PAT, GitLab token, etc.) is exfiltrated to an attacker-controlled endpoint. This token typically has read access to private repositories containing source code, secrets, and CI/CD configurations.

This follows the same threat model as GHSA-j5q5-j9gm-2w5c (published March 2026): a namespace-scoped tenant with permission to create TaskRuns exploits the git resolver to exfiltrate credentials. The prior advisory involved reading the resolver pod's ServiceAccount token via path traversal. This finding involves redirecting the system Git API token via `serverURL`.

### Patches

_(to be filled in after fix is merged and released)_

The fix validates that when `serverURL` is user-provided and differs from the system-configured server URL, the user must also provide their own `token` parameter. Using the system token with a non-system server URL is rejected.

### Workarounds

- **Do not configure a system-level API token** in the git resolver ConfigMap. Instead, require all users to provide their own tokens via the `token` parameter.
- **Restrict TaskRun creation** — limit which users or ServiceAccounts can create TaskRuns and PipelineRuns that use the git resolver.
- **Network egress policies** — apply `NetworkPolicy` to the `tekton-pipelines-resolvers` namespace to restrict outbound traffic to known-good Git servers only.

### Affected Versions

All releases from **v1.0.0** through **v1.10.0**, including all patch releases. The API mode of the git resolver has been present since the res