Linuxfoundation Tekton Pipelines vulnerabilities

• linuxfoundation tekton pipelines, tektoncd pipeline, red hat openshift lightspeed +8 more +10 more Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVE-2026-40938 Fix available 7.5 HighApril 21, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline +1 more Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion CVE-2026-40924 Fix available 6.5 MediumApril 21, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline +1 more Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check CVE-2026-40923 Fix available 5.4 MediumApril 21, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline +1 more Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL CVE-2026-40161 Fix available 7.7 HighApril 21, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline +1 more Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching CVE-2026-25542 Fix available 6.5 MediumApril 21, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline, red hat builds for red hat openshift +9 more +11 more Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod CVE-2026-33211 Fix available 9.6 CriticalMarch 18, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline +1 more Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun CVE-2026-33022 Fix available 6.5 MediumMarch 17, 2026
• linuxfoundation tekton pipelines, tektoncd pipeline +1 more Pipelines do not validate child UIDs CVE-2023-37264 3.7 LowJuly 7, 2023