CVE-2026-40923: Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

April 21, 2026 (updated May 22, 2026)

A validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at runtime.

References

github.com/advisories/GHSA-rx35-6rhx-7858
github.com/tektoncd/pipeline/releases/tag/v1.11.1
github.com/tektoncd/pipeline/security/advisories/GHSA-rx35-6rhx-7858
nvd.nist.gov/vuln/detail/CVE-2026-40923

Code Behaviors & Features

Detect and mitigate CVE-2026-40923 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →