CVE-2026-40923

2 advisories.

Go/github.com/tektoncd/pipeline CVE-2026-40923: medium 5.4

Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

Action: Upgrade github.com/tektoncd/pipeline to 1.0.2 or later.

go get github.com/tektoncd/pipeline@v1.11.1

go get github.com/tektoncd/pipeline@v1.9.3

go get github.com/tektoncd/pipeline@v1.6.2

go get github.com/tektoncd/pipeline@v1.3.4

go get github.com/tektoncd/pipeline@v1.0.2

1.11.1

1.9.3

1.6.2

1.3.4

1.0.2

CVE-2026-40923 · published 2026-04-21T20:26:41Z · modified 2026-09-10T03:51:03.014467484Z · JSON

Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline