CVE catalog
CVE-2026-40923
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass i
- Severity
- Medium · CVSS 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.22% · Oct 25, 2026
A flaw was found in Tekton Pipelines. An attacker can bypass restrictions on where volumes can be mounted by using specially crafted paths that include directory traversal sequences (e.g., `..`). This vulnerability, stemming from an incomplete path validation check, could allow unauthorized access to internal system directories, potentially leading to information disclosure or limited modification of sensitive data. github.com/tektoncd/pipeline: Tekton Pipelines: Unauthorized access and information disclosure via path validation bypass The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | tekton_pipelines | Not reported | 1.11.1 | fixed |
| Go | github.com/tektoncd/pipeline | Not reported | 1.11.1 | fixed |
| Go | github.com/tektoncd/pipeline | Not reported | 1.0.2 | fixed |
| Go | github.com/tektoncd/pipeline | Not reported | 1.3.4 | fixed |
| Go | github.com/tektoncd/pipeline | Not reported | 1.6.2 | fixed |
| Go | github.com/tektoncd/pipeline | Not reported | 1.9.3 | fixed |
| Cpe | tekton_pipelines | Not reported | 1.11.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | tekton_pipelines | cpe | Not reported | 1.11.1 | Not reported | Not reported | Not reported |
| Go | github.com/tektoncd/pipeline | Go | Not reported | 1.11.1 | Not reported | Not reported | Not reported |
| Go | github.com/tektoncd/pipeline | Go | Not reported | 1.0.2 | Not reported | Not reported | Not reported |
| Go | github.com/tektoncd/pipeline | Go | Not reported | 1.3.4 | Not reported | Not reported | Not reported |
| Go | github.com/tektoncd/pipeline | Go | Not reported | 1.6.2 | Not reported | Not reported | Not reported |
| Go | github.com/tektoncd/pipeline | Go | Not reported | 1.9.3 | Not reported | Not reported | Not reported |
| Cpe | tekton_pipelines | cpe | Not reported | 1.11.1 | Not reported | NVD-CVE-2026-40923 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://github.com/tektoncd/pipeline/releases/tag/v1.11.1]
- [https://github.com/tektoncd/pipeline/security/advisories/GHSA-rx35-6rhx-7858]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-40923]
- [https://pkg.go.dev/vuln/GO-2026-5643]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40923.json]
[FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]