6.5

CVE-2026-40924: linuxfoundation tekton_pipelines Uncontrolled Resource Consumption

CVSS: 6.5v3.1MediumModified
AliasesCGA-275g-v452-r6p9CGA-27mw-6g87-v99jCGA-3gpp-v6m4-j7xq
Published 21-04-2026Last modified 22-05-2026
Open JSON

Vulnerability summary

CVE-2026-40924 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in linuxfoundation tekton_pipelines. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.47%
0%100%
Low · +0.15 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
OPENSUSE-SU-2026:21483-1CGA-PH2Q-HVFF-MCJJ

Timeline

  1. 21-04-2026
    PublishedVulnerability first disclosed.
  2. 22-05-2026
    Last modifiedVulnerability information updated.

Description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

+0.15 pp

From 0.32% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Pipeline

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard164 products
  • tekton-chains< 0.26.3-r0
  • tekton-chains-fips< 0.26.3-r0
  • tekton-pipelines-controller-0.65All versions (No fix recorded)
  • tekton-pipelines-controller-0.68< 0.68.1-r19
  • tekton-pipelines-controller-1.0< 1.0.2-r3
Wolfi18 products
  • tekton-chains< 0.26.3-r0
  • tekton-pipelines-controller-1.10All versions (No fix recorded)
  • tekton-pipelines-controller-1.9< 1.9.3-r2
  • tekton-pipelines-entrypoint-1.10All versions (No fix recorded)
  • tekton-pipelines-entrypoint-1.9< 1.9.3-r2
Github.com/tektoncd1 product
  • pipeline≥ 1.0.0, < 1.0.2 | ≥ 1.2.0, < 1.3.4 | ≥ 1.4.0, < 1.6.2 | ≥ 1.7.0, < 1.9.3 | ≥ 1.10.0, < 1.11.1
Linuxfoundation1 product
Tektoncd1 product
  • pipeline≥ 1.0.0, < 1.0.2 | ≥ 1.2.0, < 1.3.4 | ≥ 1.4.0, < 1.6.2 | ≥ 1.7.0, < 1.9.3 | ≥ 1.10.0, < 1.11.1

5 vendors · 185 products

References

5 links