Security: Fix CVE-2026-40938 - tektoncd/pipeline git resolver argument injection

[jkhelil]

Summary

This PR fixes CVE-2026-40938 by upgrading github.com/tektoncd/pipeline from v1.6.1 to v1.6.2.

CVE Details

Field	Value
CVE ID	CVE-2026-40938
GHSA	GHSA-94jr-7pqp-xhcq
Package	github.com/tektoncd/pipeline
Severity	HIGH
Impact	Git resolver unsanitized revision parameter enables argument injection into the git CLI, potentially leading to remote code execution on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution enables full cluster-wide secret exfiltration.
Vulnerable versions	v1.0.0 – v1.6.1
Fixed version	v1.6.2
Jira Issues	SRVKP-11752

Additional CVEs Fixed in v1.6.2

This upgrade also resolves the following security issues:

• GHSA-wjxp-xrpv-xpff / CVE-2026-40161 (HIGH): Git resolver API mode leaks system-configured API token to user-controlled serverURL
• GHSA-rx35-6rhx-7858 / CVE-2026-40923 (Medium): VolumeMount path restriction bypass via missing filepath.Clean normalization
• GHSA-rmx9-2pp3-xhcr / CVE-2026-25542 (Medium): VerificationPolicy regex pattern bypass via unanchored substring matching
• GHSA-m2cx-gpqf-qf74 / CVE-2026-40924 (Medium): HTTP resolver unbounded response body read enables OOM denial of service

Changes

go.mod:   github.com/tektoncd/pipeline v1.6.1 → v1.6.2
go.sum:   updated checksums
vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/container_validation.go:     filepath.Clean fix (CVE-2026-40923)
vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/task_validation.go:    filepath.Clean fix (CVE-2026-40923)
vendor/modules.txt:  version updated

5 files changed, 12 insertions(+), 9 deletions(-)

Test Results

Status: ⚠️ TIMEOUT (no failures)

Tests discovered: Yes
Test command: go test ./...
Exit code: 124 (timeout — same behavior as previous automation runs on this repo)
Duration: 5m (timeout limit)

Result	Count
Packages passed	8
Packages failed	0
Packages timed out	remaining (long-running integration tests)

Packages passed:

• pkg/apis/operator/v1alpha1
• pkg/common
• pkg/reconciler/common
• pkg/reconciler/common/tektoninstallerset
• pkg/reconciler/kubernetes/tektonchain
• pkg/reconciler/kubernetes/tektonconfig/extension
• pkg/reconciler/kubernetes/tektondashboard
• pkg/reconciler/kubernetes/tektoninstallerset

The timeout is expected — this repo has long-running integration tests requiring a live cluster. All unit tests that completed passed with 0 failures. Full test coverage will be provided by CI after this PR.

Breaking Changes

None. This is a patch-level upgrade within the v1.6.x minor line. The only API changes are:

• filepath.Clean() applied to VolumeMount paths before the /tekton/ prefix check (CVE-2026-40923 fix) — this is a security hardening change that rejects previously-invalid paths like /tekton/../sensitive

Verification Steps

• Confirm github.com/tektoncd/pipeline is at v1.6.2 in go.mod
• Run go mod verify to confirm checksums
• Verify CVE is resolved: govulncheck -show verbose ./... should not report CVE-2026-40938
• CI tests pass
• Review VolumeMount validation change for any edge cases

Risk Assessment

Dimension	Assessment
Overall Risk	Low
Change scope	Minimal — patch upgrade within same minor version
Breaking changes	None for valid inputs
Rollback	Revert go.mod/go.sum/vendor to v1.6.1

---

🤖 Generated by CVE Fixer Workflow | Resolves: SRVKP-11752

Release Notes

Security fix: upgrade github.com/tektoncd/pipeline from v1.6.1 to v1.6.2 to address CVE-2026-40938 (HIGH) - git resolver argument injection enabling RCE and secret exfiltration.

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/lgtm

[tekton-robot]

@jkhelil: you cannot LGTM your own PR.

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mbpavan]

/lgtm