CVE-2026-40161

2 advisories.

Go/github.com/tektoncd/pipeline CVE-2026-40161: high 7.7

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Action: Upgrade github.com/tektoncd/pipeline to 1.0.2 or later.

go get github.com/tektoncd/pipeline@v1.0.2

go get github.com/tektoncd/pipeline@v1.3.4

go get github.com/tektoncd/pipeline@v1.6.2

go get github.com/tektoncd/pipeline@v1.9.3

go get github.com/tektoncd/pipeline@v1.11.1

1.0.2

1.3.4

1.6.2

1.9.3

1.11.1

CVE-2026-40161 · published 2026-04-21T18:52:18Z · modified 2026-09-10T03:51:03.718202700Z · JSON

Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline