CVE-2026-40923
Fixed in a distro release EPSS <1%CVSS 5.4
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Products: tektoncd pipeline
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/tektoncd/pipeline | 1.11.1 |
| Go | github.com/tektoncd/pipeline | 1.9.3 |
| Go | github.com/tektoncd/pipeline | 1.6.2 |
| Go | github.com/tektoncd/pipeline | 1.3.4 |
| Go | github.com/tektoncd/pipeline | 1.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | tekton-chains | 0.26.3-r0 |
| Chainguard | tekton-chains-fips | 0.26.3-r0 |
| Chainguard | tekton-pipelines-controller-0.65 | no fix |
| Chainguard | tekton-pipelines-controller-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-controller-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-1.7 | no fix |
| Chainguard | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-controller-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-controller-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-controller-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-controller-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-entrypoint-0.65 | no fix |
| Chainguard | tekton-pipelines-entrypoint-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-entrypoint-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.7 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-events-0.65 | no fix |
| Chainguard | tekton-pipelines-events-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-1.10 | no fix |
| Chainguard | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-events-1.5 | no fix |
| Chainguard | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-1.7 | no fix |
| Chainguard | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-events-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-events-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-events-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-events-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-nop-0.65 | no fix |
| Chainguard | tekton-pipelines-nop-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-nop-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-1.7 | no fix |
| Chainguard | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-nop-fips-0.65 | 0 |
| Chainguard | tekton-pipelines-nop-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-nop-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-nop-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-nop-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-resolvers-0.65 | no fix |
| Chainguard | tekton-pipelines-resolvers-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-resolvers-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-1.7 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-resolvers-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.65 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.7 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-webhook-0.65 | no fix |
| Chainguard | tekton-pipelines-webhook-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-webhook-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-1.7 | no fix |
| Chainguard | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-webhook-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-webhook-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-webhook-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-workingdirinit-0.65 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-workingdirinit-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.7 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.9 | 1.9.3-r3 |
| Chainguard | tkn | 0.44.1-r4 |
| Chainguard | tkn-fips | 0.44.1-r4 |
| Wolfi | tekton-chains | 0.26.3-r0 |
| Wolfi | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-controller-1.10 | no fix |
| Wolfi | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-entrypoint-1.10 | no fix |
| Wolfi | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-events-1.10 | no fix |
| Wolfi | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-nop-1.10 | no fix |
| Wolfi | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-resolvers-1.10 | no fix |
| Wolfi | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Wolfi | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-webhook-1.10 | no fix |
| Wolfi | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-workingdirinit-1.10 | no fix |
| Wolfi | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Wolfi | tkn | 0.44.1-r4 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |