pipeline
v1.18.0A cloud-native Pipeline resource.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 8 advisories1 critical, 2 high, 4 medium, 1 low · Scorecard 6.7/10
- Supported versions
- No scheduleendoflife.date does not track this project
9.1k stars · 2k forks · 571 open issues · last release 16 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 8 most recent advisories published by the maintainers: 1 critical, 2 high, 4 medium, 1 low. Check the patched version against the one you run.
- mediumCVE-2026-25542Apr 21, 2026VerificationPolicy regex pattern bypass via substring matching
- Affected
- >= 0.43.0, <= 1.7.0 (also present on main at 0133513db03dadb3cb08801d6b0330badcb63830)
- Patched in
- 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1
- mediumCVE-2026-40924Apr 21, 2026HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
- Affected
- <= 1.10.0
- Patched in
- 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1
- mediumCVE-2026-40923Apr 21, 2026VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
- Affected
- <= 1.10.0
- Patched in
- 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1
- highCVE-2026-40938Apr 21, 2026Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
- Affected
- >= 1.0.0
- Patched in
- 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1
- highCVE-2026-40161Apr 21, 2026Git resolver API mode leaks system-configured API token to user-controlled serverURL
- Affected
- >= 1.0.0, <= 1.10.0
- Patched in
- 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1
- criticalCVE-2026-33211Mar 18, 2026Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
- Affected
- >= 1.0.0, <= 1.10.0
- Patched in
- 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2
- mediumCVE-2026-33022Mar 16, 2026Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
- Affected
- >= 0.60.0, <= 1.10.1
- Patched in
- 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2
- lowCVE-2023-37264Jul 7, 2023Pipelines do not validate child UIDs
- Affected
- >= v0.35.0