CLEANSTART-2026-KA98572 Security fix for CVE-2026-40938 applied in: tekton-chains 0.25.2-r1, tekton-chains-fips 0.25.2-r1, tkn-fips 0.44.2-r0

CVE-2026-40938 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BW27317 Security fix for CVE-2026-40161 applied in: tekton-chains 0.25.2-r1, tekton-chains-fips 0.25.2-r1, tkn-fips 0.44.2-r0

CVE-2026-40161 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZX16649 Security fix for CVE-2026-49835 applied in: cosign 3.1.1-r1, cosign 3.1.2-r1, harbor-trivy-adapter-fips 0.36.0-r0, kyverno 1.18.1-r2, policy-controller-fips 0.15.1-r1, spire-server 1.14.7-r0, spire-server-fips 1.15.1-r1, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1

CVE-2026-49835 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IH01456 Security fix for CVE-2026-49478 applied in: cosign 2.6.5-r0, cosign 3.1.1-r1, kyverno 1.16.4-r3, kyverno 1.17.2-r2, kyverno 1.18.1-r1, kyverno 1.18.1-r2, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1

CVE-2026-49478 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OE12981 Security fix for CVE-2026-49834 applied in: cosign 3.1.1-r2, cosign 3.1.2-r1, harbor-trivy-adapter-fips 0.36.0-r1, kyverno 1.17.2-r2, kyverno 1.18.1-r2, policy-controller-fips 0.15.1-r1, spire-server 1.14.7-r0, spire-server-fips 1.15.1-r1, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1

CVE-2026-49834 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FN18256 Security fix for CVE-2026-33022 applied in: tekton-chains-fips 0.24.0-r1

Security vulnerability affects the tekton-chains-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VQ84921 Security fix for CVE-2026-25542 applied in: tekton-chains 0.25.2-r1, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1

CVE-2026-25542 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XM62440 Security fix for CVE-2026-40924 applied in: tekton-chains 0.25.2-r1, tekton-chains-fips 0.25.2-r1

CVE-2026-40924 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UI10829 Security fix for CVE-2026-40923 applied in: tekton-chains 0.25.2-r1, tekton-chains-fips 0.25.2-r1

CVE-2026-40923 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-54168

A flaw was found in Pipelines-as-Code. A GitHub App installation token, created during webhook processing, is not properly scoped when the App is installed across multiple repositories. This allows a user with push access to one repository to access private repositories within the same installati...

CVE-2026-54168

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-87065

A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to...

CVE-2026-87056

A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead...

CLEANSTART-2026-QE70350 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the tekton-chains-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See referenc...

CVE-2026-84304 vulnerabilities

Vulnerabilities for packages: kserve, livekit-egress, crossplane-provider-aws-elastictranscoder-fips, crossplane-provider-aws-networkmanager-fips, crossplane-provider-aws-connect, crossplane-provider-aws-ds-fips, cilium-cli, kubevela-fips, opensearch-datasource-fips, consul-k8s-fips,...

GHSA-VP52-PCJ8-J9QC vulnerabilities

Vulnerabilities for packages: kserve, livekit-egress, crossplane-provider-aws-elastictranscoder-fips, crossplane-provider-aws-networkmanager-fips, crossplane-provider-aws-connect, crossplane-provider-aws-ds-fips, cilium-cli, kubevela-fips, opensearch-datasource-fips, consul-k8s-fips,...

GO-2026-6225 vulnerabilities

Vulnerabilities for packages: knative-serving, tekton-pipelines-fips, tekton-pipelines, knative-serving-fips, kubeflow-katib, crossplane-fips, crossplane...

GO-2026-6225 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, knative-serving, kubeflow-katib, crossplane...

CLEANSTART-2026-IW88811 Security fixes in tekton-pipelines-fips 1.13.1-r1

Package tekton-pipelines-fips version 1.13.1-r1 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-WE59160 Security fixes in tekton-pipelines-fips 1.14.0-r4

Package tekton-pipelines-fips version 1.14.0-r4 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...