Skip to content
OpenAdvisories

Vendor

tektoncd

10 known vulnerabilities.

Products

pipeline 8 pipelines-as-code 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-54167

    Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

    Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events cont…

    tektoncd pipelines-as-code github.com/openshift-pipelines/pipelines-as-code Go
  • High 7.5
    CVE-2026-40938

    Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argumen…

    tektoncd pipeline tkn tekton-chains Wolfi Go
  • High 7.7
    CVE-2026-40161

    Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git AP…

    tektoncd pipeline tkn tekton-chains Wolfi Go