fix(cve): CVE-2026-40938, CVE-2026-40161 - bump github.com/tektoncd/pipeline to v1.11.1 [release-v0.42.2]

[divyansh42]

CVE Details

CVE-2026-40938 (Critical)

Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands

The git resolver's revision parameter is passed directly to git fetch without validation. An attacker can inject arbitrary git fetch flags via the --upload-pack= flag. Combined with permitting local filesystem paths as URLs, this can execute arbitrary binaries on the resolver pod. The tekton-pipelines-resolvers ServiceAccount has cluster-wide get/list/watch on all Secrets.

• Fixed in: github.com/tektoncd/pipeline v1.11.1
• Jira: SRVKP-11720

CVE-2026-40161 (High)

Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL

The git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL. When the user omits the token parameter, the shared API token is sent to an attacker-controlled endpoint.

• Fixed in: github.com/tektoncd/pipeline v1.10.1+
• Jira: SRVKP-11650

Fix Summary

Updated github.com/tektoncd/pipeline from v1.3.1 to v1.11.1 in go.mod and regenerated go.sum.

File	Change
go.mod	github.com/tektoncd/pipeline v1.3.1 → v1.11.1
go.sum	Updated checksums

Test Results

Check	Status	Details
go get github.com/tektoncd/pipeline@v1.11.1	✅ PASS	Dependency resolved without errors
go mod tidy -e	✅ PASS	Minor warnings for test-only transitive deps (knative.dev/pkg latest) — not build-affecting
go mod verify	✅ PASS	all modules verified

Breaking Changes

None expected. This is a patch-level update within the same major version. The tektoncd/pipeline API is stable across this range.

Risk Assessment

Low — dependency version bump to address critical security vulnerabilities. No API changes in the components used by tkn CLI. The transitive go mod tidy -e warnings are from test-only dependencies in downstream packages and do not affect the CLI build.

Verification Steps

• CI passes
• tkn commands function correctly (pipeline list, run, logs)
• No regression in git resolver behavior

Jira References

SRVKP-11720 (CVE-2026-40938, pipelines-1.20)
SRVKP-11650 (CVE-2026-40161, pipelines-1.20)

🤖 Generated with Claude Code

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign pradeepitm12 after the PR has been reviewed.
You can assign the PR to them by writing /assign @pradeepitm12 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[divyansh42]

/release-note-none

[divyansh42]

/hold