github.com/tektoncd/pipeline
A cloud-native Pipeline resource.
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 70
- Cadence
- ~12 days
- Last 12 months
- 28
Reach
- Stars
- 9.1k
Details
- First release
- Mar 27, 2019
| Version | Released | |
|---|---|---|
v1.16.0
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.16.0
minor
Dependencies (48)
+ 40 more |
|
v1.15.2
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.15.2
patch
Dependencies (48)
+ 40 more |
|
v1.9.8
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.8
patch
Dependencies (44)
+ 36 more |
|
v1.9.7
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.7
patch
Dependencies (44)
+ 36 more |
|
v1.15.1
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.15.1
patch
Dependencies (48)
+ 40 more |
|
v1.15.0
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.15.0
minor
Dependencies (47)
+ 39 more |
|
v1.6.6
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.6.6
patch
Dependencies (44)
+ 36 more |
|
v1.14.1
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.14.1
patch
Dependencies (47)
+ 39 more |
|
v1.9.6
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.6
patch
Dependencies (44)
+ 36 more |
|
v1.14.0
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.14.0
minor
Dependencies (47)
+ 39 more |
|
v1.9.5
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.5
patch
Dependencies (44)
+ 36 more |
|
v1.12.2
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.12.2
patch
Dependencies (47)
+ 39 more |
|
v1.9.4
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.4
patch
Dependencies (44)
+ 36 more |
|
v1.12.1
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.12.1
patch
Dependencies (47)
+ 39 more |
|
v1.13.1
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.1
patch
Dependencies (47)
+ 39 more |
|
v1.10.3
minor
7 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.10.3
minor
Dependencies (44)
+ 36 more |
|
v1.13.0
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.13.0
minor
Dependencies (47)
+ 39 more |
|
v1.12.0
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.12.0
minor
Dependencies (47)
+ 39 more |
|
v1.6.2
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.6.2
minor
Dependencies (44)
+ 36 more |
|
v1.11.1
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.11.1
minor
Dependencies (43)
+ 35 more |
|
v1.9.3
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.3
patch
Dependencies (44)
+ 36 more |
|
v1.11.0
minor
7 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.11.0
minor
Dependencies (43)
+ 35 more |
|
v1.9.2
minor
6 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.2
minor
Dependencies (43)
+ 35 more |
|
v1.10.2
patch
7 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.10.2
patch
Dependencies (44)
+ 36 more |
|
v1.0.1
major
6 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.0.1
major
Dependencies (45)
+ 37 more |
|
v1.10.1
patch
8 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.10.1
patch
Dependencies (44)
+ 36 more |
|
v1.10.0
minor
8 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.10.0
minor
Dependencies (44)
+ 36 more |
|
v1.9.1
minor
8 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.9.1
minor
Dependencies (43)
+ 35 more |
|
v1.1.0
minor
8 CVEs
CVE-2026-40923
GO-2026-5643
GHSA-rx35-6rhx-7858
Jun 25, 2026
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40161
GO-2026-5711
GHSA-wjxp-xrpv-xpff
Jun 25, 2026
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40924
GO-2026-5486
GHSA-m2cx-gpqf-qf74
Jun 25, 2026
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-40938
GO-2026-5272
GHSA-94jr-7pqp-xhcq
Jun 25, 2026
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33211
GO-2026-4761
GHSA-j5q5-j9gm-2w5c
Mar 23, 2026
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.11.1
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v1.1.0
minor
Dependencies (44)
+ 36 more |
|
v0.59.6
patch
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.59.6
patch
Dependencies (50)
+ 42 more |
|
v0.65.1
minor
3 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.65.1
minor
Dependencies (49)
+ 41 more |
|
v0.62.5
patch
3 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.62.5
patch
Dependencies (49)
+ 41 more |
|
v0.62.4
minor
3 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.62.4
minor
Dependencies (49)
+ 41 more |
|
v0.63.0
minor
3 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-33022
GO-2026-4730
GHSA-cv4x-93xx-wgfj
Mar 23, 2026
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline Fixed in
1.0.1
1.3.3
1.6.1
1.9.2
1.10.2
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.63.0
minor
Dependencies (49)
+ 41 more |
|
v0.56.6
patch
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.56.6
patch
Dependencies (50)
+ 42 more |
|
v0.59.0
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.59.0
minor
Dependencies (50)
+ 42 more |
|
v0.56.4
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.56.4
minor
Dependencies (50)
+ 42 more |
|
v0.47.7
patch
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.47.7
patch
Dependencies (43)
+ 35 more |
|
v0.58.0
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.58.0
minor
Dependencies (50)
+ 42 more |
|
v0.47.6
patch
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.47.6
patch
Dependencies (43)
+ 35 more |
|
v0.53.1
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.53.1
minor
Dependencies (48)
+ 40 more |
|
v0.47.5
patch
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.47.5
patch
Dependencies (43)
+ 35 more |
|
v0.50.2
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.50.2
minor
Dependencies (47)
+ 39 more |
|
v0.51.0
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.51.0
minor
Dependencies (47)
+ 39 more |
|
v0.47.4
patch
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.47.4
patch
Dependencies (43)
+ 35 more |
|
v0.47.2
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.47.2
minor
Dependencies (43)
+ 35 more |
|
v0.46.0
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.46.0
minor
Dependencies (48)
+ 40 more |
|
v0.43.2
minor
2 CVEs
CVE-2026-25542
GO-2026-5630
GHSA-rmx9-2pp3-xhcr
Jun 25, 2026
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline Fixed in
1.0.2
1.3.4
1.6.2
1.9.3
1.11.1
References
Updated Jul 23, 2026 · Source: OSV.dev
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.43.2
minor
Dependencies (44)
+ 36 more |
|
v0.38.4
patch
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.38.4
patch
Dependencies (27)
+ 19 more |
|
v0.39.0
minor
1 CVE
CVE-2023-37264
GO-2023-1901
GHSA-w2h3-vvvq-3m53
Aug 20, 2024
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline Pipelines do not validate child UIDs in github.com/tektoncd/pipeline References
Updated Feb 04, 2026 · Source: OSV.dev |
v0.39.0
minor
Dependencies (28)
+ 20 more |