What’s Vulnerable › Products

tektoncd pipeline vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your tektoncd pipeline version is affected

Latest tektoncd pipeline vulnerabilities

• CVE-2026-40938 — Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE (CVSS 8.5)
• CVE-2026-40924 — Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion (CVSS 6.5)
• CVE-2026-40923 — Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check (CVSS 5.4)
• CVE-2026-40161 — Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL (CVSS 6.5)
• CVE-2026-25542 — Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching (CVSS 6.5)
• CVE-2026-33211 — Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod (CVSS 9.6)
• CVE-2026-33022 — Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun (CVSS 6.5)
• CVE-2023-37264 — Pipelines do not validate child UIDs (CVSS 4.3)