CVE-2026-40924
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In the Tekton Pipelines project, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns referencing the HTTP resolver can point it at an attacker-controlled HTTP server returning a very large response body within the 1-minute timeout, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types run in the same pod, crashing it denies resolution service to the entire cluster, and repeated exploitation causes a sustained crash loop.
Risk Assessment
An attacker with permission to create TaskRuns or PipelineRuns can trigger repeated crashes of the resolver pod, blocking resource resolution across the entire cluster (DoS). This impacts CI/CD pipeline availability organization-wide.
Recommendation
Update Tekton Pipelines to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, or 1.11.1 (or later). Restrict permissions to create TaskRuns and PipelineRuns, and consider isolating resolvers into separate pods.
Other vulnerabilities in Tekton Pipelines
See all- CVE-2026-33211Critical
A path traversal vulnerability in the Tekton Pipelines git resolver via the `pathInRepo` parameter allows tenants with `ResolutionRequests` creation permissions to read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens.
- CVE-2026-40938High
A vulnerability in Tekton Pipelines allows an attacker to inject flags into the git fetch command via the git resolver's revision parameter. Lack of validation that the parameter does not start with a hyphen enables arbitrary binary execution on the resolver pod. Combined with allowed local filesystem URLs, an attacker can escalate privileges and exfiltrate cluster-wide secrets.
- CVE-2026-40923Medium
Tekton Pipelines starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 contains a validation bypass in the VolumeMount path restriction. Using .. path traversal components, volumes can be mounted under restricted /tekton/ internal paths. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
- CVE-2026-40161High
In the Tekton Pipelines project, versions from 1.0.0 to 1.0.1 and 1.3.4, 1.6.2, 1.9.3, 1.11.1, the Git resolver in API mode sends the configured Git API token to a user-controlled serverURL when the token parameter is omitted. A user with TaskRun or PipelineRun create permissions can exfiltrate the shared API token.
- CVE-2026-25542Medium
Vulnerability in Tekton Pipelines from version 0.43.0 prior to 1.0.2, 1.3.4, 1.6.2, 1.9.3 and 1.11.1. Trusted resources verification uses regexp.MatchString, which matches a pattern anywhere in the string, so unanchored patterns can be bypassed by attacker-controlled source strings containing the trusted pattern as a substring, potentially changing the verification mode or keys.
- CVE-2023-37264Low
The Tekton Pipelines project does not validate child UIDs in version 0.35.0 and later, allowing users with access to create TaskRuns to create their own Tasks that the Pipelines controller accepts as child Tasks.
Original NVD description (English source)
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS