Tektoncd vulnerabilities
We track 3 vulnerabilities in Tektoncd products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Tektoncd vulnerabilities
- 8.2 High severity
pipelines-as-code: Insufficient Verification of Data Authenticity
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events conta
- 8.5 High severity
pipeline: Improper Neutralization of Argument Delimiters in a Command
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument
- 9.6 Critical severity
pipeline: Improper Limitation of a Pathname to a Restricted Directory
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathIn