CVE-2026-40923

OVERVIEW CVE-2026-40923 is a validation bypass vulnerability in Tekton Pipelines versions prior to 1.11.1 that affects the VolumeMount path restriction mechanism. The flaw allows attackers to circumvent security controls designed to prevent mounting volumes under restricted /tekton/ internal paths by leveraging path traversal techniques. Specifically, the validation uses strings.HasPrefix without proper path normalization via filepath.Clean, allowing paths such as /tekton/home/../results to bypass restrictions during validation but resolve to restricted /tekton/results directories at runtime. SEVERITY The vulnerability carries a CVSS v3.1 score of 5.4 (MEDIUM) with a network-based attack vector, low attack complexity, and requires low-level privileges to exploit. An authenticated user can trigger this vulnerability with no user interaction required. While the impact is limited to low confidentiality and integrity compromise with no availability impact, it does permit unauthorized access to and potential modification of sensitive internal pipeline data within the /tekton/ directory structure. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.00038 indicating minimal probability of near-term exploitation. The vulnerability is not present on the Known Exploited Vulnerabilities (KEV) catalog and shows no activity on exploitation tracking lists. The straightforward nature of the bypass and moderate severity rating suggest community attention remains low relative to other vulnerabilities in Tekton infrastructure projects.