chainguard/tekton-pipelines-controller-1.9

Vulnerabilities (18)

• CVE-2026-41178MedJun 4, 2026
  affected < 1.9.5-r1fixed 1.9.5-r1

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the iss

• CVE-2026-42507MedJun 2, 2026
  affected < 1.9.3-r5fixed 1.9.3-r5

  When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

• CVE-2026-42504HigJun 2, 2026
  affected < 1.9.3-r5fixed 1.9.3-r5

  Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

• CVE-2026-27145MedJun 2, 2026
  affected < 1.9.3-r5fixed 1.9.3-r5

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratic

• CVE-2026-33814HigMay 7, 2026
  affected < 1.9.3-r1fixed 1.9.3-r1

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

• CVE-2026-40938HigApr 21, 2026
  affected < 1.9.3-r2fixed 1.9.3-r2

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch withou

• CVE-2026-40924MedApr 21, 2026
  affected < 1.9.3-r2fixed 1.9.3-r2

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size

• CVE-2026-40923MedApr 21, 2026
  affected < 1.9.3-r2fixed 1.9.3-r2

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tek

• CVE-2026-40161HigApr 21, 2026
  affected < 1.9.3-r2fixed 1.9.3-r2

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-con

• CVE-2026-25542MedApr 21, 2026
  affected < 1.9.3-r2fixed 1.9.3-r2

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.

• CVE-2026-39883HigApr 8, 2026
  affected < 1.9.2-r2fixed 1.9.2-r2

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platf

• CVE-2026-39882MedApr 8, 2026
  affected < 1.9.3-r4fixed 1.9.3-r4

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector e

• CVE-2026-34986HigApr 6, 2026
  affected < 1.9.2-r1fixed 1.9.2-r1

  Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JW

• CVE-2026-33211Mar 23, 2026
  affected < 1.9.2-r0fixed 1.9.2-r0

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A t

• CVE-2026-33022Mar 20, 2026
  affected < 1.9.2-r0fixed 1.9.2-r0

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can creat

• CVE-2025-15558Mar 4, 2026
  affected < 1.9.1-r2fixed 1.9.1-r2

  Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are

• CVE-2026-24051HigFeb 2, 2026
  affected < 1.9.1-r1fixed 1.9.1-r1

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system comman

• CVE-2023-37264Jul 7, 2023
  affected < 0fixed 0

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will ac