Skip to content
OpenAdvisories

Package · Go

github.com/tektoncd/pipeline

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-40923

    Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes …

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-40924

    Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with …

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-25542

    Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSour…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-33022

    Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows a…

    tektoncd pipeline github.com/tektoncd/pipeline Go