CVE-2026-33022 Details
Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
A denial-of-service vulnerability has been identified in Tekton Pipelines versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1. The issue allows any user who can create a TaskRun or PipelineRun to crash the Tekton controller cluster-wide. This is achieved by setting the resolver name in the task or pipeline reference to a string of 31 or more characters. The controller panics because the generated name exceeds the 63-character limit for DNS-1123 labels. The truncation logic fails, causing a slice bounds panic, which crashes the controller. Once restarted, the controller enters a CrashLoopBackOff state, blocking all CI/CD reconciliation until the problematic resource is manually deleted. Built-in resolvers are not affected, but any custom resolver name can trigger the vulnerability.
Users can upgrade to Tekton Pipelines versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2, where this vulnerability has been patched. Additionally, it is recommended to restrict the ability to create TaskRuns and PipelineRuns through Kubernetes RBAC.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation tekton pipelines | >= 0.60.0, < 1.0.1 >= 1.1.0, < 1.3.3 >= 1.4.0, < 1.6.1 >= 1.7.0, < 1.9.2 >= 1.10.0, < 1.10.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |