Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

### Summary A validation bypass in the VolumeMount path restriction allows mounting volumes under restricted `/tekton/` internal paths by using `..` path traversal components. The restriction check uses `strings.HasPrefix` without `filepath.Clean`, so a path like `/tekton/home/../results` passes validation but resolves to `/tekton/results` at runtime. ### Details Tekton Pipelines restricts VolumeMount paths under `/tekton/` (except `/tekton/home`) to prevent users from interfering with internal execution state. The validation at `pkg/apis/pipeline/v1/container_validation.go` checks mount paths using `strings.HasPrefix` without normalizing the path first: ```go if strings.HasPrefix(vm.MountPath, "/tekton/") && !strings.HasPrefix(vm.MountPath, "/tekton/home") { // reject } ``` Because `/tekton/home` is an allowed prefix, a path like `/tekton/home/../results` passes both checks. At runtime, the container runtime resolves `..` and the actual mount point becomes `/tekton/results`. The same pattern exists in `pkg/apis/pipeline/v1beta1/task_validation.go`. ### Impact An authenticated user with Task or TaskRun creation permissions can mount volumes over internal Tekton paths, potentially: - Writing fake task results that downstream pipelines trust - Reading or modifying step scripts before execution - Interfering with entrypoint coordination state ### Patches _(to be filled: fixed in versions X.Y.Z)_ ### Workarounds - Use admission controllers (OPA/Gatekeeper, Kyverno) to validate that VolumeMount paths do not contain `..` components. - In multi-tenant setups, restrict who can create Task and TaskRun resources via RBAC. ### Affected Versions All versions through **v1.10.0** (both `v1` and `v1beta1` APIs). ### Acknowledgments This vulnerability was reported by @kodareef5.

Source published

21 Apr 2026 20:26:41 UTC

Source modified

10 Sep 2026 03:51:03 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Publisher rating · MODERATE