Validation Bypass Vulnerability in Tekton Pipelines by Tectonic
CVE-2026-40923

5.4MEDIUM

Key Information:

Vendor

Tektoncd

Status
Pipeline
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40923?

The Tekton Pipelines project, designed for handling CI/CD workflows with Kubernetes-style resources, has a vulnerability that allows unauthorized volume mounts. This occurs due to a failure in path validation when using the .. path traversal components, enabling attackers to mount volumes in restricted internal paths. Specifically, prior to version 1.11.1, the system improperly validates paths with strings.HasPrefix without utilizing filepath.Clean. As a result, a path such as /tekton/home/../results is erroneously allowed, which ultimately resolves to /tekton/results during execution. Users are advised to upgrade to version 1.11.1 or later to mitigate this issue.

Affected Version(s)

pipeline < 1.11.1

References

https://github.com/tektoncd/pipeline/security/advisories/...
x_refsource_CONFIRM
https://github.com/tektoncd/pipeline/releases/tag/v1.11.1
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.