CVE-2026-33022
CVE-2026-33022 is a medium-severity vulnerability in Linuxfoundation Tekton Pipelines with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-129.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 0% (29th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-13615
- Weakness: CWE-129
- Affected product: Linuxfoundation Tekton Pipelines
- Published:
- Last modified:
Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
Frequently asked questions
- What is CVE-2026-33022?
- Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
- How severe is CVE-2026-33022?
- CVE-2026-33022 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-33022 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-33022?
- CVE-2026-33022 affects Linuxfoundation Tekton Pipelines. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-33022?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-33022 have an EU (EUVD) identifier?
- Yes. CVE-2026-33022 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13615.
- When was CVE-2026-33022 published?
- CVE-2026-33022 was published on 2026-03-20 and last updated on 2026-06-17.
References
- https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj
Affected products (1)
- cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*
More vulnerabilities in Linuxfoundation Tekton Pipelines
- CVE-2026-33211 — Critical (CVSS 9.6): Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0…
- CVE-2026-40161 — High (CVSS 7.7): Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0…
- CVE-2026-40938 — High (CVSS 7.5): Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0…
- CVE-2026-40924 — Medium (CVSS 6.5): Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0…
- CVE-2026-25542 — Medium (CVSS 6.5): Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0…
- CVE-2026-40923 — Medium (CVSS 5.4): Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0…
All CVEs affecting Linuxfoundation Tekton Pipelines →
Other CWE-129 (Improper Validation of Array Index) vulnerabilities
- CVE-2020-27485 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
- CVE-2020-27483 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
- CVE-2026-21413 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
- CVE-2025-27034 — Critical (CVSS 9.8): Memory corruption while selecting the PLMN from SOR failed list.
- CVE-2025-3357 — Critical (CVSS 9.8): IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code…
- CVE-2024-45569 — Critical (CVSS 9.8): Memory corruption while parsing the ML IE due to invalid frame content.
Browse all CWE-129 (Improper Validation of Array Index) vulnerabilities →