CVE-2026-33022 (GCVE-0-2026-33022)

Vulnerability from cvelistv5 – Published: 2026-03-20 07:48 – Updated: 2026-03-20 18:07
VLAI?
Title
Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
Summary
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-129 - Improper Validation of Array Index
Assigner
References
Impacted products
Vendor Product Version
tektoncd pipeline Affected: >= 0.60.0, < 1.0.1
Affected: >= 1.1.0, < 1.3.3
Affected: >= 1.4.0, < 1.6.1
Affected: >= 1.7.0, < 1.9.2
Affected: >= 1.10.0, < 1.10.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33022",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T16:22:10.536063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T18:07:35.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pipeline",
          "vendor": "tektoncd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.60.0, \u003c 1.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 1.3.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.9.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T07:48:15.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj"
        },
        {
          "name": "https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6"
        }
      ],
      "source": {
        "advisory": "GHSA-cv4x-93xx-wgfj",
        "discovery": "UNKNOWN"
      },
      "title": "Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33022",
    "datePublished": "2026-03-20T07:48:15.383Z",
    "dateReserved": "2026-03-17T17:22:14.667Z",
    "dateUpdated": "2026-03-20T18:07:35.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33022",
      "date": "2026-04-25",
      "epss": "0.00018",
      "percentile": "0.04654"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33022\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-20T08:16:11.293\",\"lastModified\":\"2026-03-24T16:19:48.663\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.\"},{\"lang\":\"es\",\"value\":\"El proyecto Tekton Pipelines proporciona recursos estilo k8s para declarar pipelines estilo CI/CD. Las versiones 0.60.0 a 1.0.0, 1.1.0 a 1.3.2, 1.4.0 a 1.6.0, 1.7.0 a 1.9.0, 1.10.0 y 1.10.1 tienen una vulnerabilidad de denegaci\u00f3n de servicio que permite a cualquier usuario que pueda crear un TaskRun o PipelineRun bloquear el controlador en todo el cl\u00faster al establecer .spec.taskRef.resolver (o .spec.pipelineRef.resolver) a una cadena de 31 o m\u00e1s caracteres. El bloqueo ocurre porque GenerateDeterministicNameFromSpec produce un nombre que excede el l\u00edmite de etiqueta DNS-1123 de 63 caracteres, y su l\u00f3gica de truncamiento entra en p\u00e1nico en un l\u00edmite de segmento [-1] ya que el nombre generado no contiene espacios. Una vez bloqueado, el controlador entra en un CrashLoopBackOff al reiniciar (ya que vuelve a reconciliar el recurso infractor), bloqueando toda la reconciliaci\u00f3n de CI/CD hasta que el recurso se elimine manualmente. Los resolvedores incorporados (git, cluster, bundles, hub) no se ven afectados debido a sus nombres cortos, pero cualquier nombre de resolvedor personalizado activa el error. La soluci\u00f3n trunca el prefijo del nombre del resolvedor en lugar de la cadena completa, preservando el sufijo hash para determinismo y unicidad. Este problema ha sido parcheado en las versiones 1.0.1, 1.3.3, 1.6.1, 1.9.2 y 1.10.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"0.60.0\",\"versionEndExcluding\":\"1.0.1\",\"matchCriteriaId\":\"F365D90F-DED5-4C32-9C73-3D5FF467778B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"1.1.0\",\"versionEndExcluding\":\"1.3.3\",\"matchCriteriaId\":\"510D5C7F-FB2A-4059-AF03-A85FD23267F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"1.4.0\",\"versionEndExcluding\":\"1.6.1\",\"matchCriteriaId\":\"B4303F35-5E39-4F4B-9258-FE58CCA3C760\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"1.7.0\",\"versionEndExcluding\":\"1.9.2\",\"matchCriteriaId\":\"C465CD0F-E9E8-414D-9BED-49BEBD394E95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"1.10.0\",\"versionEndExcluding\":\"1.10.2\",\"matchCriteriaId\":\"871426E3-9DCC-43CE-8262-D87D4F040AEE\"}]}]}],\"references\":[{\"url\":\"https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33022\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-20T16:22:10.536063Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-20T16:22:21.183Z\"}}], \"cna\": {\"title\": \"Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun\", \"source\": {\"advisory\": \"GHSA-cv4x-93xx-wgfj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"tektoncd\", \"product\": \"pipeline\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.60.0, \u003c 1.0.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.1.0, \u003c 1.3.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.4.0, \u003c 1.6.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.7.0, \u003c 1.9.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.10.0, \u003c 1.10.2\"}]}], \"references\": [{\"url\": \"https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj\", \"name\": \"https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6\", \"name\": \"https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-129\", \"description\": \"CWE-129: Improper Validation of Array Index\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-20T07:48:15.383Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33022\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-20T18:07:35.331Z\", \"dateReserved\": \"2026-03-17T17:22:14.667Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-20T07:48:15.383Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.