CVE-2026-33022: Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
(updated )
A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31 characters or more, causing a denial of service for all reconciliation.
References
- github.com/advisories/GHSA-cv4x-93xx-wgfj
- github.com/tektoncd/pipeline
- github.com/tektoncd/pipeline/commit/01673237c464cfac7e286183f5c9e9d6ec951a64
- github.com/tektoncd/pipeline/commit/0fa2d66cff814838c3a10cce252104c7fe618932
- github.com/tektoncd/pipeline/commit/5e4905fb6754efa5ecea54de195738d73fb0e01d
- github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6
- github.com/tektoncd/pipeline/commit/ebc197e2b9733deedaa1624212ec66dcdf61eaaf
- github.com/tektoncd/pipeline/commit/edc64bbf22323fcf218170f19047c9bcd8163e90
- github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj
- nvd.nist.gov/vuln/detail/CVE-2026-33022
Code Behaviors & Features
Detect and mitigate CVE-2026-33022 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →