Skip to content
Tektoncd Pipeline vulnerabilities
-
tektoncd pipelines-as-code
Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
CVE-2026-54168
Fix available
6.5 Medium
-
tektoncd pipelines-as-code
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
CVE-2026-54167
Fix available
8.2 High
-
linuxfoundation tekton pipelines, tektoncd pipeline, red hat openshift lightspeed +8 more +10 more
Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
CVE-2026-40938
Fix available
7.5 High
-
linuxfoundation tekton pipelines, tektoncd pipeline +1 more
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
CVE-2026-40924
Fix available
6.5 Medium
-
linuxfoundation tekton pipelines, tektoncd pipeline +1 more
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
CVE-2026-40923
Fix available
5.4 Medium
-
linuxfoundation tekton pipelines, tektoncd pipeline +1 more
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
CVE-2026-40161
Fix available
7.7 High
-
linuxfoundation tekton pipelines, tektoncd pipeline +1 more
Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
CVE-2026-25542
Fix available
6.5 Medium
-
linuxfoundation tekton pipelines, tektoncd pipeline, red hat builds for red hat openshift +9 more +11 more
Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
CVE-2026-33211
Fix available
9.6 Critical
-
linuxfoundation tekton pipelines, tektoncd pipeline +1 more
Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
CVE-2026-33022
Fix available
6.5 Medium
-
linuxfoundation tekton pipelines, tektoncd pipeline +1 more
Pipelines do not validate child UIDs
CVE-2023-37264
3.7 Low