CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
An attacker can crash the Tekton controller by creating a TaskRun with a long custom resolver name, blocking all CI/CD operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33022?
CVE-2026-33022 is a medium-severity denial of service vulnerability in tektoncd pipeline, published on 20 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
Weakness: CWE-129
Which versions are affected by CVE-2026-33022?
11 open source packages ship an affected version, including github.com/tektoncd/pipeline. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tektoncd/pipeline Go | From 0.60.0 | 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2 |
github.com/tektoncd/pipeline Go | From 0.60.0 | 1.0.1 |
github.com/tektoncd/pipeline Go | From 0.60.0 | 1.0.1 |
github.com/tektoncd/pipeline Go | From 1.1.0 | 1.3.3 |
github.com/tektoncd/pipeline Go | From 1.1.0 | 1.3.3 |
github.com/tektoncd/pipeline Go | From 1.10.0 | 1.10.2 |
5 more packages
github.com/tektoncd/pipeline Go | From 1.10.0 | 1.10.2 |
github.com/tektoncd/pipeline Go | From 1.4.0 | 1.6.1 |
github.com/tektoncd/pipeline Go | From 1.4.0 | 1.6.1 |
github.com/tektoncd/pipeline Go | From 1.7.0 | 1.9.2 |
github.com/tektoncd/pipeline Go | From 1.7.0 | 1.9.2 |
Products include Linuxfoundation Tekton Pipelines.
How do I fix CVE-2026-33022?
Upgrade github.com/tektoncd/pipeline to a fixed version for your release line: 1.0.1, 1.3.3, 1.6.1 or 1.9.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33022 being exploited?
There is no known exploitation of CVE-2026-33022 in the wild and no public exploit code.
Other vulnerabilities in tektoncd pipeline
- CVE-2026-33211 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
- CVE-2026-40161 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
- CVE-2026-40938 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
- CVE-2026-25542 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
- CVE-2026-40924 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
Sources
Also known as CLEANSTART-2026-FN18256, GHSA-cv4x-93xx-wgfj, GO-2026-4730.