{"id":"EUVD-2026-24481","enisaUuid":"51b55d9c-09c2-36be-8d0c-405ce33e2003","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","datePublished":"Apr 21, 2026, 8:50:53 PM","dateUpdated":"May 22, 2026, 3:41:51 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rx35-6rhx-7858\nhttps://github.com/tektoncd/pipeline/releases/tag/v1.11.1\n","aliases":"CVE-2026-40923\nGHSA-rx35-6rhx-7858\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"33e0dcbc-e61e-32c6-a6b7-c80aacd6a4ad","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.10.0, \u003c 1.11.1"},{"id":"59defc22-2786-3020-8ddc-6bdb727c2dd5","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.2.0, \u003c 1.3.4"},{"id":"aa18b844-6da9-3d0c-b669-4f2fbd38ca4b","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.7.0, \u003c 1.9.3"},{"id":"dceabba1-4de3-3f71-bc6d-2edfc100c112","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.0.0, \u003c 1.0.2"},{"id":"e43a66fd-adb4-3cc9-8197-fe57f35a419a","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.4.0, \u003c 1.6.2"}],"enisaIdVendor":[{"id":"8dd3ebcc-2b2e-399d-b9ec-52c10364b502","vendor":{"name":"tektoncd"}}],"enisaIdVulnerability":[{"id":"c18da3d2-a02b-34e9-8c78-5f597a04f8ea","vulnerability":{"id":"GHSA-rx35-6rhx-7858","description":"Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check","datePublished":"Apr 21, 2026, 8:26:41 PM","dateUpdated":"May 22, 2026, 3:40:40 PM","baseScore":0.0,"references":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rx35-6rhx-7858\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40923\nhttps://github.com/tektoncd/pipeline\nhttps://github.com/tektoncd/pipeline/releases/tag/v1.11.1\n","enisa_id":"EUVD-2026-24481\n","aliases":"CVE-2026-40923\nGHSA-rx35-6rhx-7858\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cbedf5aa-a41f-318b-a296-78ebb2568a1e","vulnerability":{"id":"CVE-2026-40923","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","datePublished":"Apr 21, 2026, 8:50:53 PM","dateUpdated":"May 22, 2026, 3:41:51 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rx35-6rhx-7858\nhttps://github.com/tektoncd/pipeline/releases/tag/v1.11.1\n","enisa_id":"EUVD-2026-24481\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"46a348fa-06a0-364f-b885-abbfd71d9405","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.7.0, \u003c 1.9.3"},{"id":"664a28f6-01bf-3b62-afdb-ecfb8db5f1be","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.0.0, \u003c 1.0.2"},{"id":"a72109bb-2db1-3550-833e-da13b09600d5","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.10.0, \u003c 1.11.1"},{"id":"e2dc1b69-9586-3673-aab1-187680015474","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.4.0, \u003c 1.6.2"},{"id":"ebff4a1e-4fc6-3876-912e-62daeffe1fc4","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.2.0, \u003c 1.3.4"}],"vulnerabilityVendor":[{"id":"d28da674-dd3f-3614-b28c-cafae21fa5e0","vendor":{"name":"tektoncd"}}]}}],"enisaIdAdvisory":[]}