Tekton Pipelines vulnerabilities

2 known vulnerabilities in Tekton Pipelines from Linux Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  pipeline: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-40938Apr 21, 2026Tektoncd

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument

• 9.6 Critical severity

  pipeline: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-33211Mar 24, 2026Tektoncd

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathIn