CVE-2023-37264
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Tekton Pipelines project does not validate child UIDs in version 0.35.0 and later, allowing users with access to create TaskRuns to create their own Tasks that the Pipelines controller accepts as child Tasks.
Risk Assessment
This allows users to modify the configuration of Pipelines at runtime, violating SLSA L2 Service Generated / Non-falsifiable requirements. The risk may vary depending on the Tekton setup.
Recommendation
It is recommended to restrict access to create TaskRuns only to trusted users and to monitor system activity. Additionally, keep track of the availability of patches for this vulnerability.
Other vulnerabilities in Tekton Pipelines
See all- CVE-2026-40161High
In the Tekton Pipelines project, versions from 1.0.0 to 1.0.1 and 1.3.4, 1.6.2, 1.9.3, 1.11.1, the Git resolver in API mode sends the configured Git API token to a user-controlled serverURL when the token parameter is omitted. A user with TaskRun or PipelineRun create permissions can exfiltrate the shared API token.
- CVE-2026-33211Critical
A path traversal vulnerability in the Tekton Pipelines git resolver via the `pathInRepo` parameter allows tenants with `ResolutionRequests` creation permissions to read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens.
- CVE-2026-40938High
A vulnerability in Tekton Pipelines allows an attacker to inject flags into the git fetch command via the git resolver's revision parameter. Lack of validation that the parameter does not start with a hyphen enables arbitrary binary execution on the resolver pod. Combined with allowed local filesystem URLs, an attacker can escalate privileges and exfiltrate cluster-wide secrets.
Original NVD description (English source)
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child Task. While the software stores and validates the PipelineRun's (api version, kind, name, uid) in the child Run's OwnerReference, it only store (api version, kind, name) in the ChildStatusReference. This means that if a client had access to create TaskRuns on a cluster, they could create a child TaskRun for a pipeline with the same name + owner reference, and the Pipeline controller picks it up as if it was the original TaskRun. This is problematic since it can let users modify the config of Pipelines at runtime, which violates SLSA L2 Service Generated / Non-falsifiable requirements. This issue can be used to trick the Pipeline controller into associating unrelated Runs to the Pipeline, feeding its data through the rest of the Pipeline. This requires access to create TaskRuns, so impact may vary depending on one Tekton setup. If users already have unrestricted access to create any Task/PipelineRun, this does not grant any additional capabilities. As of time of publication, there are no known patches for this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS