Red Hat OpenShift Pipelines vulnerabilities

8 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Exploited Red Hat OpenShift Pipelines vulnerabilities

CVE-2026-10840 — Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources (CVSS 7.1)
CVE-2026-29063 — Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable (CVSS 9.8)
CVE-2025-11065 — Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure (CVSS 5.3)
CVE-2025-8556 — Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results (CVSS 3.7)
CVE-2024-11831 — Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (CVSS 5.4)
CVE-2024-9355 — Golang-fips: golang fips zeroed buffer (CVSS 6.5)
CVE-2023-48795 — Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin (CVSS 5.9)
CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited