PT-2026-25993 · Unknown · Tekton Pipelines

1Seal · Published 2026-03-17 · Updated 2026-03-27 · CVE-2026-33022

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 0.60.0 through 1.10.1

Description Tekton Pipelines is susceptible to a denial-of-service issue. A user with the ability to create TaskRun or PipelineRun resources can cause the Tekton Pipelines controller to crash by setting the .spec.taskRef.resolver or .spec.pipelineRef.resolver parameter to a string of 31 or more characters. The crash occurs because the GenerateDeterministicNameFromSpec function produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic results in a panic. This leads to a CrashLoopBackOff state, blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are not affected, but any custom resolver name triggers the issue. The function GenerateDeterministicNameFromSpec is involved in the crash.

Recommendations Versions prior to 1.0.1 are vulnerable. Versions 1.1.0 through 1.3.2 are vulnerable. Versions 1.4.0 through 1.6.0 are vulnerable. Versions 1.7.0 through 1.9.0 are vulnerable. Versions 1.10.0 and 1.10.1 are vulnerable. Restrict who can create TaskRun and PipelineRun resources via Kubernetes RBAC.

Exploit

Fix

Resource Exhaustion

Improper Validation of Array Index

Weakness Enumeration

CWE-400

CWE-129

Related Identifiers

CVE-2026-33022

GHSA-CV4X-93XX-WGFJ

GO-2026-4730

SUSE-SU-2026:1135-1

Affected Products

Tekton Pipelines

References · 155

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33022.json · Exploit
• https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6 · Patch
• https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cv4x-93xx-wgfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33022 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4730 · Vendor Advisory
• https://github.com/tektoncd/pipeline · Note
• https://github.com/tektoncd/pipeline/commit/5e4905fb6754efa5ecea54de195738d73fb0e01d · Note
• https://github.com/tektoncd/pipeline/commit/ebc197e2b9733deedaa1624212ec66dcdf61eaaf · Note
• https://github.com/tektoncd/pipeline/commit/01673237c464cfac7e286183f5c9e9d6ec951a64 · Note
• https://github.com/tektoncd/pipeline/commit/0fa2d66cff814838c3a10cce252104c7fe618932 · Note
• https://github.com/tektoncd/pipeline/commit/edc64bbf22323fcf218170f19047c9bcd8163e90 · Note
• https://suse.com/security/cve/CVE-2026-33283 · Note