tektoncd pipelines-as-code vulnerabilities (CVE)

CVE records published for tektoncd pipelines-as-code, newest first. Follow to get an email when a new one appears.

2 results

8.2High

CVE-2026-54167 1 month ago

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

tektoncd pipelines-as-code

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events cont…

6.5Medium

CVE-2026-54168 1 month ago

Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

tektoncd pipelines-as-code

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that trigge…