EUVD-2026-24481
GHSA-rx35-6rhx-7858
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable via Kubernetes API (AV:N); low privilege required for Task/TaskRun creation (PR:L); confidentiality and integrity each partially impacted, no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. This vulnerability is fixed in 1.11.1.
AnalysisAI
VolumeMount path restriction bypass in Tekton Pipelines prior to v1.11.1 permits authenticated users holding Task or TaskRun creation permissions to mount volumes over internal /tekton/ paths using dot-dot traversal sequences, violating Tekton's internal execution isolation boundary. The flaw exists in both the v1 and v1beta1 API validation layers (pkg/apis/pipeline/v1/container_validation.go and pkg/apis/pipeline/v1beta1/task_validation.go), where strings.HasPrefix is applied to the raw, un-normalized mount path instead of the filepath.Clean-resolved form. No public exploit code has been identified and SSVC assessment confirms no active exploitation; however, in shared or multi-tenant Kubernetes CI/CD environments the integrity risk is meaningful - an attacker can inject falsified task results trusted by downstream pipelines, alter step scripts before execution, or disrupt entrypoint coordination state.
Technical ContextAI
Tekton Pipelines (CPE: cpe:2.3:a:tektoncd:pipeline:*:*:*:*:*:*:*:*) is a Kubernetes-native CI/CD framework that models build and deployment workflows as Kubernetes custom resources (Tasks, TaskRuns, Pipelines). To prevent user-supplied workloads from interfering with its internal execution directories, the framework rejects VolumeMount paths that begin with /tekton/ (with an exception for /tekton/home). This guard is implemented in Go using strings.HasPrefix against the raw user-supplied path string. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal') applies because the path is not canonicalized via filepath.Clean before comparison: a path such as /tekton/home/../results satisfies the /tekton/home allowlist prefix literally but resolves at runtime to /tekton/results, a restricted internal directory used to pass signed task output between pipeline steps. The dual-API nature of the bug (v1 and v1beta1 resources) means all common Task authoring interfaces are affected.
RemediationAI
Upgrade to Tekton Pipelines v1.11.1 ('Javanese Jocasta'), the primary vendor-confirmed fix, deployable with: kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.11.1/release.yaml (release advisory: https://github.com/tektoncd/pipeline/releases/tag/v1.11.1; security advisory: https://github.com/tektoncd/pipeline/security/advisories/GHSA-rx35-6rhx-7858). Backport patches are also available: v1.9.3, v1.6.2, and v1.3.4 for environments on older supported branches. For environments that cannot immediately patch, the GHSA advisory recommends two compensating controls: first, deploy an admission controller such as OPA/Gatekeeper or Kyverno with a policy that rejects VolumeMount paths containing '..' components - this intercepts malicious manifests at admission time before the vulnerable validation code runs, with the trade-off that policy authoring and maintenance overhead increases. Second, restrict Task and TaskRun creation permissions via Kubernetes RBAC to only trusted identities in multi-tenant clusters, reducing the attacker population; the trade-off is reduced developer self-service capability.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today