tektoncd vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20269

Newest CVEs

• CVE-2026-54167

  Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

  tektoncd · pipelines-as-code

  High8.2
• CVE-2026-54168

  Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

  tektoncd · pipelines-as-code

  Medium6.5
• CVE-2026-40923

  Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

  tektoncd · pipeline

  Medium5.4
• CVE-2026-40924

  Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

  tektoncd · pipeline

  Medium6.5
• CVE-2026-40938

  Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

  tektoncd · pipeline

  High7.5
• CVE-2026-40161

  Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

  tektoncd · pipeline

  High7.7
• CVE-2026-25542

  Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

  tektoncd · pipeline

  Medium6.5
• CVE-2026-33211

  Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

  tektoncd · pipeline

  Critical9.6
• CVE-2026-33022

  Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

  tektoncd · pipeline

  Medium6.5
• CVE-2023-37264

  Pipelines do not validate child UIDs

  tektoncd · pipeline

  Low3.7