Critical9.6Vendor: HighRed Hat Linux

Critical [CVE-2026-33211] Information disclosure via path traversal in git resolver

This critical-severity Red Hat Linux advisory covers CVE-2026-33211 affecting Red Hat OpenShift Builds 1.6.5, Red Hat OpenShift Builds 1.7.4, Red Hat OpenShift Pipelines 1.21.

CVE-2026-33211 Published Mar 23, 2026

CVE-2026-33211

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Information disclosure via path traversal in git resolver. Red Hat rates this important (CVSS 9.6).

Weakness: CWE-22. Affected package(s): openshift-builds/openshift-builds-rhel9-operator:1776860241, serve-tkn-cli, openshift-pipelines/pipelines-resolvers-rhel9:1774556280, openshift-pipelines/pipelines-resolvers-rhel9:1774596617, openshift-builds/openshift-builds-rhel9-operator:1776859898, openshift-pipelines/pipelines-operator-bundle:1776925111.

Resolved in Red Hat advisory RHSA-2026:21932 — update the affected packages (`sudo dnf update`).

Affected products named by the advisory: Red Hat OpenShift Builds 1.6.5; Red Hat OpenShift Builds 1.7.4; Red Hat OpenShift Pipelines 1.21; Red Hat Trusted Artifact Signer 1.3; and 4 more.

Affected versions

openshift-builds/openshift-builds-rhel9-operator:1776860241
serve-tkn-cli-1-21-serve-tkn-cli-1.21.1
openshift-pipelines/pipelines-resolvers-rhel9:1774556280
openshift-pipelines/pipelines-resolvers-rhel9:1774596617
openshift-builds/openshift-builds-rhel9-operator:1776859898
openshift-pipelines/pipelines-operator-bundle:1776925111
openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9:1779865001
openshift-pipelines/pipelines-operator-bundle:1774871390
rhtas/client-server-rhel9:1776339099
openshift-pipelines/pipelines-operator-bundle:1780044955

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

RHSA-2026:21932

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Update the affected package(s) to the fixed version shipped in RHSA-2026:21932 (`sudo dnf update` / `yum update`).

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.