- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 1 critical, 2 high, 4 medium, 1 low
- Registry
- pkg.go.dev
Advisories 8
- CVE-2026-40923Medium 5.4
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
Affected: from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 1.10.0, fixed in 1.11.1; from 1.7.0, fixed in 1.9.3; from 1.4.0, fixed in 1.6.2; from 1.2.0, fixed in 1.3.4; from 1.0.0, fixed in 1.0.2.
- CVE-2026-40924Medium 6.5
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
Affected: from 1.10.0, fixed in 1.11.1; from 1.0.0, fixed in 1.0.2; from 1.2.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1.
- CVE-2026-40938High 7.5
Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
Affected: from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 1.10.0, fixed in 1.11.1; from 1.7.0, fixed in 1.9.3; from 1.4.0, fixed in 1.6.2; from 1.2.0, fixed in 1.3.4; from 1.0.0, fixed in 1.0.2.
- CVE-2026-40161High 7.7
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
Affected: from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 1.0.0, fixed in 1.0.2; from 1.2.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1.
- CVE-2026-25542Medium 6.5
Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
Affected: from 0.43.0, fixed in 1.0.2; from 1.2.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 0.43.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1.
- CVE-2026-33211Critical 9.6
Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
Affected: from 1.0.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.2; from 1.0.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.11.1.
- CVE-2026-33022Medium 6.5
Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
Affected: from 0.60.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.2; from 0.60.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.2.
- CVE-2023-37264Low 3.7
Pipelines do not validate child UIDs
Affected: from 0.35.0; from 0.35.0, through 0.52.0.