Skip to content
OpenAdvisories

Package · Go

github.com/tektoncd/pipeline

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 5.4
    CVE-2026-40923

    Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes …

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-40924

    Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with …

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • High 7.5
    CVE-2026-40938

    Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argumen…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • High 7.7
    CVE-2026-40161

    Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git AP…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-25542

    Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSour…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Critical 9.6
    CVE-2026-33211

    Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathI…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-33022

    Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows a…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Low 3.7
    CVE-2023-37264

    Pipelines do not validate child UIDs

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelin…

    tektoncd pipeline github.com/tektoncd/pipeline Go