5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40923

CVE-2026-40923: Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime. This vulnerability is fixed in 1.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40923

CVE-2026-40923:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/tektoncd/pipeline	go	<= 1.11.0	1.11.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in two separate locations, one for the v1 API and one for the v1beta1 API of Tekton Pipelines. In both cases, the code that validates volumeMounts for steps in a Task fails to properly sanitize the mount path. The validation logic checks if the path starts with the restricted /tekton/ prefix, but it does so without first normalizing the path. This creates a path traversal vulnerability where a user can specify a path like /tekton/home/../results, which passes the validation because it starts with the allowed /tekton/home prefix, but is later resolved by the container runtime to /tekton/results, a restricted path. This could allow an attacker to overwrite internal Tekton state, such as task results, leading to a compromise of the pipeline's integrity. The patch for this vulnerability involves using filepath.Clean to normalize the mount path before performing the prefix check, thus preventing the path traversal.

Vulnerable functions

Step.Validate

pkg/apis/pipeline/v1/container_validation.go

The `Validate` function for a `Step` in the v1 API did not properly sanitize the `volumeMount.mountPath` field. It checked for the restricted `/tekton/` prefix without first normalizing the path. This allowed an attacker to use path traversal characters (e.g., `..`) to bypass the check. For example, a path like `/tekton/home/../results` would pass validation but be resolved to the restricted `/tekton/results` path by the container runtime.

validateStep

pkg/apis/pipeline/v1beta1/task_validation.go

The `validateStep` function in the v1beta1 API did not properly sanitize the `volumeMount.mountPath` field. It checked for the restricted `/tekton/` prefix without first normalizing the path. This allowed an attacker to use path traversal characters (e.g., `..`) to bypass the check. For example, a path like `/tekton/home/../results` would pass validation but be resolved to the restricted `/tekton/results` path by the container runtime.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.