Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-40938 high CVSS 7.5

Vulnerability in github.com/tektoncd/pipeline (CVE-2026-40938)

Summary

Vulnerability in github.com/tektoncd/pipeline (CVE-2026-40938). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1 or later.

Original description

The description as published by the source.

Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A weakness called CVE-2026-40938 was discovered in github.com/tektoncd/pipeline.
Severity is High (CVSS 7.5/10). If exploited, attackers can leak data or disrupt key functionality.
What you should do: update the affected software to the latest version. If unsure, ask your IT team or search the vendor's site for "github.com/tektoncd/pipeline CVE-2026-40938".

CVE-2026-40938 (github.com/tektoncd/pipeline). Severity: High / CVSSv3 7.5. Category: CWE-88.
Response plan:

  1. Check the vendor advisory for affected versions and the patched release.
  2. If a vulnerable version is running in production, schedule maintenance (urgency from KEV/CVSS).
  3. If no patch yet, mitigate via WAF rule, disabling the affected feature, etc.
  4. Monitor logs / SIEM for known IOC and PoC signatures of this CVE.
    PoCs and fix commits: see the 'References' section, MITRE, and NVD.
❓ What is the problem

A weakness (CVE-2026-40938) in github.com/tektoncd/pipeline. A serious software flaw has been identified.

📍 Affected scope

Target versions of github.com/tektoncd/pipeline (see vendor advisory). If running in production, identify exposure immediately.

🔥 Severity

Severity: High (CVSS 7.5/10). If exploited, attackers can leak data or disrupt key functionality.

🔧 How to fix

Update to the patched release as listed in the vendor advisory. (Typical mitigation pattern for CWE-88)

🛡️ Workaround

If a patch is not yet available, consider disabling the affected feature, applying WAF rules, blocking via network ACLs, or isolating the vulnerable version.

🔍 Detection

Check version information, scan dependencies via SBOM, and monitor SIEM for IOC and PoC signatures related to this CVE.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'github.com/tektoncd/pipeline' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/tektoncd/pipeline を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade github.com/tektoncd/pipeline to 1.0.2

    ステージング環境で 1.0.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

go github.com/tektoncd/pipeline
[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2"},{"introduced":"1.1.0"},{"fixed":"1.3.4"},{"introduced":"1.4.0"},{"fixed":"1.6.2"},{"introduced":"1.7.0"},{"fixed":"1.9.3"},{"introduced":"1.10.0"},{"fixed":"1.11.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details