Read the docs
TI-2026-25468 Aliases CVE-2026-33022GHSA-cv4x-93xx-wgfj

Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

Priority LOW 29CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Partial pipeline (tektoncd): 1.0.1, 1.3.3, 1.6.1 +2github.com/tektoncd/pipeline (Go): 1.0.1, 1.3.3, 1.6.1 +2Red Hat: 4 advisoriesRed Hat: 2 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagepipeline0.60.0 to before 1.0.1; 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.21.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2Patch availableCNA
—github.com/tektoncd/pipeline (Go)0.60.0 to before 1.0.11.0.1Patch availableGHSA-cv4x-93xx-wgfj
—github.com/tektoncd/pipeline (Go)1.1.0 to before 1.3.31.3.3Patch availableGHSA-cv4x-93xx-wgfj
—github.com/tektoncd/pipeline (Go)1.4.0 to before 1.6.11.6.1Patch availableGHSA-cv4x-93xx-wgfj
—github.com/tektoncd/pipeline (Go)1.7.0 to before 1.9.21.9.2Patch availableGHSA-cv4x-93xx-wgfj
—github.com/tektoncd/pipeline (Go)1.10.0 to before 1.10.21.10.2Patch availableGHSA-cv4x-93xx-wgfj
  • pipeline Vendorbackstage Affected 0.60.0 to before 1.0.1; 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.2 Fixed in 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2 Patch available CNA
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 0.60.0 to before 1.0.1 Fixed in 1.0.1 Patch available GHSA-cv4x-93xx-wgfj
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.1.0 to before 1.3.3 Fixed in 1.3.3 Patch available GHSA-cv4x-93xx-wgfj
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.4.0 to before 1.6.1 Fixed in 1.6.1 Patch available GHSA-cv4x-93xx-wgfj
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.7.0 to before 1.9.2 Fixed in 1.9.2 Patch available GHSA-cv4x-93xx-wgfj
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.10.0 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-cv4x-93xx-wgfj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*0.60.0 to before 1.0.1; 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:* Versions 0.60.0 to before 1.0.1; 1.1.0 to before 1.3.3; 1.4.0 to before 1.6.1; 1.7.0 to before 1.9.2; 1.10.0 to before 1.10.2 Vulnerable ·backstage

Remediation

  • Fix · CNA pipeline (tektoncd) Fixed in 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2
  • Fix · GHSA-cv4x-93xx-wgfj github.com/tektoncd/pipeline (Go) Fixed in 1.0.1 Advisory →
  • Fix · GHSA-cv4x-93xx-wgfj github.com/tektoncd/pipeline (Go) Fixed in 1.3.3 Advisory →
  • Fix · GHSA-cv4x-93xx-wgfj github.com/tektoncd/pipeline (Go) Fixed in 1.6.1 Advisory →
  • Fix · GHSA-cv4x-93xx-wgfj github.com/tektoncd/pipeline (Go) Fixed in 1.9.2 Advisory →
  • Fix · GHSA-cv4x-93xx-wgfj github.com/tektoncd/pipeline (Go) Fixed in 1.10.2 Advisory →

Red Hat 4 advisories

  • RHSA-2026:10066 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.4
    • Red Hat OpenShift Pipelines 1.2 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
  • RHSA-2026:10026 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.20.4
    • Red Hat OpenShift Pipelines 1.2 registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9
  • RHSA-2026:6170 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.1
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle
Show 1 more Red Hat advisories
  • RHSA-2026:6166 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.1
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9, registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9, registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Builds for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 4AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet: Fix deferred
Red Hat OpenShift Pipelines 1.2Fixed RHSA-2026:10026, RHSA-2026:10066
Red Hat OpenShift Pipelines 1.21Fixed RHSA-2026:6166, RHSA-2026:6170
Not affected: 2 products
  • Red Hat OpenShift Pipelines 1.2
  • Red Hat OpenShift Pipelines 1.21

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33022
  2. 2026-10-03 Alias added: GHSA-cv4x-93xx-wgfj
  3. 2026-11-06 Fix available: RHSA-2026:6166 · Red Hat

References

Patch 2

Advisory 1

Other 6

  • TI-2026-29590 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVSS 3.1HIGH 8.5
  • TI-2026-29578 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2023-18894 Pipelines do not validate child UIDs CVSS 3.1MEDIUM 4.3
  • TI-2026-25632 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod CVSS 3.1CRITICAL 9.6
  • TI-2026-28976 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL CVSS 3.1HIGH 7.7
  • TI-2026-20651 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching CVSS 3.1MEDIUM 6.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences