CVE-2026-33022: Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
(updated )
A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31 characters or more, causing a denial of service for all reconciliation.
References
- github.com/advisories/GHSA-cv4x-93xx-wgfj
- github.com/tektoncd/pipeline
- github.com/tektoncd/pipeline/commit/01673237c464cfac7e286183f5c9e9d6ec951a64
- github.com/tektoncd/pipeline/commit/0fa2d66cff814838c3a10cce252104c7fe618932
- github.com/tektoncd/pipeline/commit/5e4905fb6754efa5ecea54de195738d73fb0e01d
- github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6
- github.com/tektoncd/pipeline/commit/ebc197e2b9733deedaa1624212ec66dcdf61eaaf
- github.com/tektoncd/pipeline/commit/edc64bbf22323fcf218170f19047c9bcd8163e90
- github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj
- nvd.nist.gov/vuln/detail/CVE-2026-33022
Code Behaviors & Features
Detect and mitigate CVE-2026-33022 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →