# github.com/tektoncd/pipeline (Go) vulnerabilities

8 known vulnerabilities (1 critical, 2 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/tektoncd/pipeline

## Advisories (8)

### [CVE-2026-40923](https://cve.now/CVE-2026-40923): Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

- Severity: Medium 5.4
- Published: Apr 21, 2026
- Affected: from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 1.10.0, fixed in 1.11.1; from 1.7.0, fixed in 1.9.3; from 1.4.0, fixed in 1.6.2; from 1.2.0, fixed in 1.3.4; from 1.0.0, fixed in 1.0.2.

### [CVE-2026-40924](https://cve.now/CVE-2026-40924): Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

- Severity: Medium 6.5
- Published: Apr 21, 2026
- Affected: from 1.10.0, fixed in 1.11.1; from 1.0.0, fixed in 1.0.2; from 1.2.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1.

### [CVE-2026-40938](https://cve.now/CVE-2026-40938): Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

- Severity: High 7.5
- Published: Apr 21, 2026
- Affected: from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 1.10.0, fixed in 1.11.1; from 1.7.0, fixed in 1.9.3; from 1.4.0, fixed in 1.6.2; from 1.2.0, fixed in 1.3.4; from 1.0.0, fixed in 1.0.2.

### [CVE-2026-40161](https://cve.now/CVE-2026-40161): Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

- Severity: High 7.7
- Published: Apr 21, 2026
- Affected: from 1.0.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 1.0.0, fixed in 1.0.2; from 1.2.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1.

### [CVE-2026-25542](https://cve.now/CVE-2026-25542): Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

- Severity: Medium 6.5
- Published: Apr 21, 2026
- Affected: from 0.43.0, fixed in 1.0.2; from 1.2.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1; from 0.43.0, fixed in 1.0.2; from 1.1.0, fixed in 1.3.4; from 1.4.0, fixed in 1.6.2; from 1.7.0, fixed in 1.9.3; from 1.10.0, fixed in 1.11.1.

### [CVE-2026-33211](https://cve.now/CVE-2026-33211): Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

- Severity: Critical 9.6
- Published: Mar 23, 2026
- Affected: from 1.0.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.2; from 1.0.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.11.1.

### [CVE-2026-33022](https://cve.now/CVE-2026-33022): Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

- Severity: Medium 6.5
- Published: Mar 20, 2026
- Affected: from 0.60.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.2; from 0.60.0, fixed in 1.0.1; from 1.1.0, fixed in 1.3.3; from 1.4.0, fixed in 1.6.1; from 1.7.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.2.

### [CVE-2023-37264](https://cve.now/CVE-2023-37264): Pipelines do not validate child UIDs

- Severity: Low 3.7
- Published: Jul 7, 2023
- Affected: from 0.35.0; from 0.35.0, through 0.52.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/tektoncd/pipeline
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.