CVE-2026-40161
Fixed in a distro release EPSS <1%CVSS 7.7
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Products: tektoncd pipeline
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/tektoncd/pipeline | 1.0.2 |
| Go | github.com/tektoncd/pipeline | 1.3.4 |
| Go | github.com/tektoncd/pipeline | 1.6.2 |
| Go | github.com/tektoncd/pipeline | 1.9.3 |
| Go | github.com/tektoncd/pipeline | 1.11.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | tekton-chains | 0.27.0-r0 |
| Chainguard | tekton-chains-fips | 0.27.0-r0 |
| Chainguard | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-controller-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-1.7 | no fix |
| Chainguard | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-controller-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-entrypoint-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.7 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-1.10 | no fix |
| Chainguard | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-events-1.5 | no fix |
| Chainguard | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-1.7 | no fix |
| Chainguard | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-events-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-events-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-nop-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-1.7 | no fix |
| Chainguard | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-nop-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-resolvers-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-1.7 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.7 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-webhook-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-1.7 | no fix |
| Chainguard | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-webhook-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-workingdirinit-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.7 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.9 | 1.9.3-r3 |
| Chainguard | tkn | 0.44.1-r4 |
| Chainguard | tkn-fips | 0.44.1-r4 |
| Wolfi | tekton-chains | 0.27.0-r0 |
| Wolfi | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-controller-1.10 | no fix |
| Wolfi | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-entrypoint-1.10 | no fix |
| Wolfi | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-events-1.10 | no fix |
| Wolfi | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-nop-1.10 | no fix |
| Wolfi | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-resolvers-1.10 | no fix |
| Wolfi | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Wolfi | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-webhook-1.10 | no fix |
| Wolfi | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-workingdirinit-1.10 | no fix |
| Wolfi | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Wolfi | tkn | 0.44.1-r4 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |