281 matches found
CVE-2026-40923
A flaw was found in Tekton Pipelines. An attacker can bypass restrictions on where volumes can be mounted by using specially crafted paths that include directory traversal sequences e.g., ... This vulnerability, stemming from an incomplete path validation check, could allow unauthorized access to...
CVE-2026-40161
A flaw was found in Tekton Pipelines. A tenant with permissions to create TaskRun or PipelineRun resources can exploit this vulnerability. By omitting the Git API token parameter and pointing the serverURL to an attacker-controlled endpoint, the system-configured Git API token such as a GitHub...
CVE-2026-40923 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tkn...
CVE-2026-40938 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tkn...
CVE-2026-40924 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tkn...
GHSA-M2CX-GPQF-QF74 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tkn...
GHSA-94JR-7PQP-XHCQ vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tkn...
GHSA-RX35-6RHX-7858 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, tekton-chains, tkn...
SUSE CVE-2026-25542
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string refSource.URI against spec.resources.pattern...
SUSE CVE-2026-40161
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL...
SUSE CVE-2026-40923
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal pat...
SUSE CVE-2026-40924
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAllresp.Body with no response body size limit. Any tenant...
SUSE CVE-2026-40938
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation...
GHSA-94JR-7PQP-XHCQ vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-pipelines, tkn-fips, tekton-chains-fips, tekton-chains, tkn...
GHSA-M2CX-GPQF-QF74 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-pipelines, tkn-fips, tekton-chains-fips, tekton-chains, tkn...
CVE-2026-40923 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-pipelines, tkn-fips, tekton-chains-fips, tekton-chains, tkn...
CVE-2026-40938 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-pipelines, tkn-fips, tekton-chains-fips, tekton-chains, tkn...
GHSA-RX35-6RHX-7858 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-pipelines, tkn-fips, tekton-chains-fips, tekton-chains, tkn...
CVE-2026-40924 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-pipelines, tkn-fips, tekton-chains-fips, tekton-chains, tkn...
CVE-2026-25542
A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the regexp.MatchString function in Go matching patterns anywhere within a string, rather than...