Kubernetes CI/CD Flaws in Tekton and Argo Require Immediate Patching

Two newly reported Kubernetes CI/CD vulnerabilities affect Tekton Pipelines and Argo Workflows, with both issues tied to insufficient validation of user-supplied fields in cluster workflow objects. CVE-2026-40923 allows a VolumeMount.mountPath path restriction bypass in Tekton Pipelines because admission webhooks failed to normalize paths, enabling traversal patterns such as ..; the fix is to upgrade to Tekton Pipelines 1.11.1 or later, which adds filepath.Clean logic. CVE-2026-40886 causes a denial of service in Argo Workflows through unchecked parsing of the workflows.argoproj.io/pod-gc-strategy annotation, and is fully patched in Argo Workflows 3.7.14 and 4.0.5.

Where upgrades cannot be applied immediately, defenders are advised to enforce Kubernetes admission policies using OPA Gatekeeper, Kyverno, or native validating controls to block malicious Tekton Task and TaskRun requests and to validate incoming Argo Workflow annotations. The guidance also calls for tightening RBAC so only trusted CI/CD service accounts and authorized personnel can create Tekton resources, restricting namespace access to limit blast radius, and, in Argo environments already forced into a controller crash loop, manually deleting the malicious Workflow object from the Kubernetes API so the controller can recover.