1131 matches found
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...
GO-2026-6223 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...
GO-2026-6223 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: flux-kustomize-controller, kwok, kubernetes-csi-external-attacher, cilium, grafana, cluster-api-helm-controller, fluent-operator, rancher-agent, cert-manager, external-secrets-operator, openfga, istio, yunikorn-k8shim, kubernetes-csi-external-resizer, spicedb,...
GHSA-48P8-G2FX-3WWM vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...
CVE-2026-73643 vulnerabilities
Vulnerabilities for packages: renovate, authentik-fips, kubeflow-pipelines...
CVE-2026-73643 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, renovate...
GHSA-48P8-G2FX-3WWM vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
CVE-2026-54526 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
CVE-2026-54526 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...
GO-2026-5711 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...
GO-2026-4730 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...
GO-2026-5486 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...
GO-2026-5272 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...
GO-2026-5643 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...
GO-2026-4761 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...
GO-2026-5630 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tkn, tkn-fips, tekton-chains, tekton-pipelines, tekton-pipelines-fips...