Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-33022— Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

Quick assessment

Affected
tektoncd pipeline
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tekton Pipelines是Tekton开源的一个云原生管道。 Tekton Pipelines 0.60.0至1.0.0版本、1.1.0至1.3.2版本、1.4.0至1.6.0版本、1.7.0至1.9.0版本、1.10.0版本和1.10.1版本存在输入验证错误漏洞，该漏洞源于设置过长的解析器名称会导致控制器崩溃，可能导致集群范围的拒绝服务。

CVSS 6.5 · Medium EPSS 0.38% · P31

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-33022

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
Source: CVE Program / CVE List V5
Vulnerability Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Tekton Pipelines 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tekton Pipelines是Tekton开源的一个云原生管道。 Tekton Pipelines 0.60.0至1.0.0版本、1.1.0至1.3.2版本、1.4.0至1.6.0版本、1.7.0至1.9.0版本、1.10.0版本和1.10.1版本存在输入验证错误漏洞，该漏洞源于设置过长的解析器名称会导致控制器崩溃，可能导致集群范围的拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
tektoncd pipeline >= 0.60.0, < 1.0.1 -

II. Public POCs for CVE-2026-33022

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-33022

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-33022 (1)

Vendor Advisories for CVE-2026-33022 (1)

IV. Related Vulnerabilities

Same product: pipeline
Same vendor: tektoncd
Same weakness: CWE-129