Skip to content
OpenAdvisories

Vendor

tektoncd

10 known vulnerabilities.

tektoncd at a glance

Last 12 months
9
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities, 1 critical Mar April 2026: 5 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 2 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202620
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202650
Mar 202621
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

pipeline 8 pipelines-as-code 2
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • High 8.2
    CVE-2026-54167

    Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

    Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events cont…

    tektoncd pipelines-as-code github.com/openshift-pipelines/pipelines-as-code Go
  • Medium 6.5
    CVE-2026-54168

    Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

    Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that trigge…

    tektoncd pipelines-as-code github.com/openshift-pipelines/pipelines-as-code Go
  • Medium 5.4
    CVE-2026-40923

    Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes …

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-40924

    Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with …

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • High 7.5
    CVE-2026-40938

    Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argumen…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • High 7.7
    CVE-2026-40161

    Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git AP…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-25542

    Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSour…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Critical 9.6
    CVE-2026-33211

    Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathI…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Medium 6.5
    CVE-2026-33022

    Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows a…

    tektoncd pipeline github.com/tektoncd/pipeline Go
  • Low 3.7
    CVE-2023-37264

    Pipelines do not validate child UIDs

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelin…

    tektoncd pipeline github.com/tektoncd/pipeline Go