Ttektoncd

Products

Exploited and recent CVEs

• CVE-2026-54167 High 8.2 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header 0.3%
• CVE-2026-54168 Medium 6.5 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution 0.6%
• CVE-2026-40923 Medium 5.4 Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check 0.2%
• CVE-2026-40924 Medium 6.5 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion 0.3%
• CVE-2026-40938 High 7.5 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE 0.8%
• CVE-2026-40161 High 7.7 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL 0.3%
• CVE-2026-25542 Medium 6.5 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching 0.3%
• CVE-2026-33211 Critical 9.6 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod 0.6%
• CVE-2026-33022 Medium 6.5 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun 0.4%
• CVE-2023-37264 Low 3.7 Pipelines do not validate child UIDs 0.4%