336 matches found
GHSA-J5Q5-J9GM-2W5C vulnerabilities
Vulnerabilities for packages: tkn, tekton-chains...
CVE-2026-33211 vulnerabilities
Vulnerabilities for packages: tkn, tekton-chains...
GHSA-J5Q5-J9GM-2W5C vulnerabilities
Vulnerabilities for packages: tekton-chains, tekton-pipelines, tekton-chains-fips, tekton-pipelines-fips, tkn-fips, tkn...
CVE-2026-33211 vulnerabilities
Vulnerabilities for packages: tekton-chains, tekton-pipelines, tekton-chains-fips, tekton-pipelines-fips, tkn-fips, tkn...
GHSA-J5Q5-J9GM-2W5C Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
Summary The Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests e.g. by creating TaskRuns or PipelineRuns that use the git resolver can read arbitrary files from the resolver pod's filesystem, including...
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
Summary The Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests e.g. by creating TaskRuns or PipelineRuns that use the git resolver can read arbitrary files from the resolver pod's filesystem, including...
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
Summary A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver or .spec.pipelineRef.resolver to a string of 31 characters or more, causing a denial of service for all reconciliation. Details The controller...
GHSA-CV4X-93XX-WGFJ Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
Summary A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver or .spec.pipelineRef.resolver to a string of 31 characters or more, causing a denial of service for all reconciliation. Details The controller...
PT-2026-25993
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 0.60.0 through 1.10.1 Description Tekton Pipelines is susceptible to a denial-of-service issue. A user with the ability to create TaskRun or PipelineRun resources can cause the Tekton Pipelines controller to crash by...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: local-static-provisioner, kepler, newrelic-infrastructure-agent, prometheus-blackbox-exporter, emqx-exporter-fips, cis-operator, kube-bench, portieris-fips, nri-mssql, nri-postgresql, aws-ebs-csi-driver-fips, newrelic-nri-statsd, crossplane-provider-aws-memorydb,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: kepler, newrelic-infrastructure-agent, prometheus-blackbox-exporter, emqx-exporter-fips, aws-ebs-csi-driver-fips, crossplane-provider-aws-memorydb, argo-workflows-fips, kubernetes-dashboard-api, prometheus-blackbox-exporter-fips, langfuse-fips, tempo, temporal-fips,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: local-static-provisioner, kepler, newrelic-infrastructure-agent, prometheus-blackbox-exporter, emqx-exporter-fips, cis-operator, kube-bench, portieris-fips, nri-mssql, nri-postgresql, aws-ebs-csi-driver-fips, newrelic-nri-statsd, crossplane-provider-aws-memorydb,...
CVE-2025-15558 vulnerabilities
Vulnerabilities for packages: flux, traefik, aactl, trufflehog, vendir, kwok, flux-helm-controller, kyverno-notation-aws, scorecard, ko, tekton-chains, trivy-operator, gh, lazydocker, argo-workflows, k3d, teleport, vcluster, knative-serving, kubescape-operator, dagdotdev, osv-scanner, vitess,...
GHSA-P436-GJF2-799P vulnerabilities
Vulnerabilities for packages: flux, traefik, aactl, trufflehog, vendir, kwok, flux-helm-controller, kyverno-notation-aws, scorecard, ko, tekton-chains, trivy-operator, gh, lazydocker, argo-workflows, k3d, teleport, vcluster, knative-serving, kubescape-operator, dagdotdev, osv-scanner, vitess,...
GHSA-P436-GJF2-799P vulnerabilities
Vulnerabilities for packages: openbao, cloudbeat, k9s-fips, vexctl, k9s, trivy-operator, cloudbeat-fips, nerdctl, argo-workflows, rancher-fleet-fips, argo-workflows-fips, ory-kratos, kyverno-policy-reporter-plugins-kyverno, spire-server, kbld-fips, minio-operator-fips,...
CVE-2025-15558 vulnerabilities
Vulnerabilities for packages: openbao, cloudbeat, k9s-fips, vexctl, k9s, trivy-operator, cloudbeat-fips, nerdctl, argo-workflows, rancher-fleet-fips, argo-workflows-fips, ory-kratos, kyverno-policy-reporter-plugins-kyverno, spire-server, kbld-fips, minio-operator-fips,...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: aws-ebs-csi-driver-fips, argo-workflows, velero, argo-workflows-fips, calico-fips, spire-server, temporal-fips, flux-kustomize-controller-fips, docker-compose-fips, gitlab-cng-fips, headlamp-fips, percona-server-mongodb-operator, kube-arangodb, kubevirt-cdi-operator,...
GHSA-72C7-4G63-HPW5 vulnerabilities
Vulnerabilities for packages: tkn, tekton-chains...