VDB
CVE-2026-40923
CVE-2026-40923
PUBLISHED
CVSS 5.400000095367432 MEDIUM
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. This vulnerability is fixed in 1.11.1.
EPSS 0.05% · 16.4th percentile
Risk Scores
CVSS v3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.05%
16.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | tektoncd/pipeline | 0 |
| tektoncd | pipeline | < 1.11.1 |
Timeline
- Apr 21, 2026 CVE Published
- Apr 21, 2026 CVE Updated
- Apr 21, 2026 PoC Published
- Apr 22, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score