Go/github.com/tektoncd/pipeline

Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

Modified: 9/10/2026

Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun

Modified: 9/10/2026

Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

Modified: 9/10/2026

Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

Modified: 9/10/2026

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching

Modified: 9/10/2026

Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

Modified: 9/10/2026

Pipelines do not validate child UIDs

Modified: 9/10/2026

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Modified: 9/10/2026

Pipelines do not validate child UIDs in github.com/tektoncd/pipeline

Modified: 2/4/2026

Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline

Modified: 7/23/2026

Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline

Modified: 7/23/2026

Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline

Modified: 7/23/2026

Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline

Modified: 7/23/2026

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline

Modified: 7/23/2026

Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline

Modified: 7/23/2026

Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline

Modified: 7/23/2026