Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy, spqr, flux-kustomize-controller, spicedb, kube-state-metrics, rancher-system-agent, cert-manager-istio-csr, hubble, flux-notification-controller, rke2-cloud-provider, cluster-api-aws-controller, emissary, calico, cluster-api-provider-vsphere,...

GO-2026-5711 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2026-4730 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2026-5272 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2026-5486 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2026-5643 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2025-4028 vulnerabilities

Vulnerabilities for packages: tekton-chains, tkn, tkn-fips, tekton-chains-fips...

GO-2026-5630 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2026-4761 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn-fips...

GO-2023-1901 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, tekton-pipelines-fips...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: gitsign, falcoctl-fips, vexctl, kubescape, falcoctl, tekton-chains, cosign-fips...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: gitsign, falcoctl-fips, spire-server-fips, minio, vexctl, kubescape, external-secrets-fips, falcoctl, mc, boring-registry, tekton-chains, spire-server, cosign-fips...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, skaffold, spire-server-fips, ko, slsa-verifier, kubescape, apko, cosign, policy-controller, tkn, flux-source-controller, tekton-chains, melange, aactl, spire-server...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, kubescape, zarf, tekton-chains, melange, ko, neuvector-sigstore-interface, flux-source-controller, falcoctl, goreleaser, tkn-fips, policy-controller-fips, tekton-chains-fips, gitsign, chainctl, vexctl, policy-controller, tkn, zot, aactl, spire-server,...

GO-2026-4761 vulnerabilities

Vulnerabilities for packages: tkn, tekton-pipelines, tekton-chains...

GO-2026-5630 vulnerabilities

Vulnerabilities for packages: tkn, tekton-pipelines, tekton-chains...

GO-2026-5711 vulnerabilities

Vulnerabilities for packages: tkn, tekton-pipelines, tekton-chains...

GO-2025-4028 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains...

GO-2026-5643 vulnerabilities

Vulnerabilities for packages: tkn, tekton-pipelines, tekton-chains...