303 matches found
CVE-2026-87065
A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to...
CVE-2026-87056
A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead...
CLEANSTART-2026-QE70350 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
Multiple security vulnerabilities affect the tekton-chains-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See referenc...
CVE-2026-84304 vulnerabilities
Vulnerabilities for packages: vault-secrets-operator-fips, crossplane-provider-aws-quicksight-fips, task, helmfile, nifikop-fips, terraform-provider-grafana, dapr, metallb, crossplane-provider-aws-apprunner, ksops-fips, crossplane-provider-gitlab-fips, crossplane-provider-aws-cur-fips,...
GHSA-VP52-PCJ8-J9QC vulnerabilities
Vulnerabilities for packages: vault-secrets-operator-fips, crossplane-provider-aws-quicksight-fips, task, helmfile, nifikop-fips, terraform-provider-grafana, dapr, metallb, crossplane-provider-aws-apprunner, ksops-fips, crossplane-provider-gitlab-fips, crossplane-provider-aws-cur-fips,...
GO-2026-6225 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, crossplane-fips, knative-serving, kubeflow-katib, tekton-pipelines, crossplane, knative-serving-fips...
GO-2026-6225 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, crossplane, knative-serving, kubeflow-katib...
CLEANSTART-2026-IW88811 Security fixes in tekton-pipelines-fips 1.13.1-r1
Package tekton-pipelines-fips version 1.13.1-r1 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...
CLEANSTART-2026-GR84261 Security fixes in tekton-chains-fips 0.24.0-r1
Package tekton-chains-fips version 0.24.0-r1 fixes 26 vulnerabilities: CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859...
CLEANSTART-2026-WE59160 Security fixes in tekton-pipelines-fips 1.14.0-r4
Package tekton-pipelines-fips version 1.14.0-r4 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...
CLEANSTART-2026-NJ73427 Security fixes in tekton-chains-fips 0.25.2-r1
Package tekton-chains-fips version 0.25.2-r1 fixes 31 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...
CLEANSTART-2026-NZ51335 Security fixes in tekton-chains-fips 0.26.5-r1
Package tekton-chains-fips version 0.26.5-r1 fixes 25 vulnerabilities: CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859...
CLEANSTART-2026-RM68806 Security fixes in tekton-chains 0.26.5-r1
Package tekton-chains version 0.26.5-r1 fixes 15 vulnerabilities: ghsa-gcjh-h69q-9w9g, CVE-2026-49478, CVE-2026-48702, CVE-2026-54787, CVE-2026-49834...
CLEANSTART-2026-HA54107 Security fixes in tekton-chains 0.25.2-r1
Package tekton-chains version 0.25.2-r1 fixes 23 vulnerabilities: ghsa-gcjh-h69q-9w9g, ghsa-pmwq-pjrm-6p5r, CVE-2026-49478, CVE-2026-48702, CVE-2026-49834...
CLEANSTART-2026-KH43508 Security fixes in tekton-pipelines-fips 1.13.1-r2
Package tekton-pipelines-fips version 1.13.1-r2 fixes 8 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kapp-controller, kube-rbac-proxy, flux-notification-controller, spicedb, tetragon, cloud-provider-vsphere, rancher-system-agent, emissary, tkn, rancher, tekton-pipelines, kubernetes-csi-external-snapshotter, cloud-provider-gcp-cloud-controller-manager,...
GO-2026-5711 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tkn-fips, tkn, tekton-pipelines, tekton-chains-fips, tekton-chains...