Linuxfoundation Tekton Pipelines vulnerabilities

8 CVEs affecting Linuxfoundation Tekton Pipelines, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40938, published 2026-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-40938, published 2026-04-21. High severity, CVSS 8.5. EPSS: 0.9% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's…
CVE-2026-33211, published 2026-03-24. Critical severity, CVSS 9.6. EPSS: 0.7% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines…
CVE-2026-40924, published 2026-04-21. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's…
CVE-2026-33022, published 2026-03-20. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and…
CVE-2026-40161, published 2026-04-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines…
CVE-2026-25542, published 2026-04-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources…
CVE-2023-37264, published 2023-07-07. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to…
CVE-2026-40923, published 2026-04-21. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass…