CVE-2026-33022
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Mar 20, 2026
CISA due date
—
The record
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | tekton-chains | 0 | 0.26.2-r5 |
| Chainguard | tekton-chains-fips | 0 | 0.26.2-r6 |
| Chainguard | tekton-pipelines-controller-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-controller-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-controller-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-controller-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-controller-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-controller-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-controller-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-controller-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-entrypoint-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-entrypoint-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-entrypoint-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-entrypoint-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-events-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-events-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-events-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-events-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-events-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-events-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-events-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-events-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-nop-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-nop-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-nop-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-nop-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-nop-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-nop-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-nop-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-nop-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-resolvers-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-resolvers-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-resolvers-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-resolvers-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-resolvers-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-resolvers-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-resolvers-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-resolvers-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-webhook-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-webhook-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-webhook-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-webhook-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-webhook-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-webhook-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-webhook-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-webhook-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tekton-pipelines-workingdirinit-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-workingdirinit-1.3 | 0 | 1.3.3-r0 |
| Chainguard | tekton-pipelines-workingdirinit-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-workingdirinit-1.9 | 0 | 1.9.2-r0 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.0 | 0 | 1.0.1-r1 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.3 | 0 | 1.3.3-r1 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.6 | 0 | 1.6.1-r1 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.9 | 0 | 1.9.2-r1 |
| Chainguard | tkn | 0 | 0.44.0-r4 |
| Chainguard | tkn-fips | 0 | 0.44.0-r5 |
| Wolfi | tekton-chains | 0 | 0.26.2-r5 |
| Wolfi | tekton-pipelines-controller-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-controller-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-controller-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-controller-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-entrypoint-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-entrypoint-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-entrypoint-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-entrypoint-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-events-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-events-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-events-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-events-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-nop-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-nop-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-nop-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-nop-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-resolvers-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-resolvers-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-resolvers-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-resolvers-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-webhook-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-webhook-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-webhook-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-webhook-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tekton-pipelines-workingdirinit-1.0 | 0 | 1.0.1-r1 |
| Wolfi | tekton-pipelines-workingdirinit-1.3 | 0 | 1.3.3-r0 |
| Wolfi | tekton-pipelines-workingdirinit-1.6 | 0 | 1.6.1-r1 |
| Wolfi | tekton-pipelines-workingdirinit-1.9 | 0 | 1.9.2-r0 |
| Wolfi | tkn | 0 | 0.44.0-r4 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260326T203309-150000.1.155.2 |
Related vulnerabilities
- CVE-2026-33211 Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Also affects tekton-chains
- CVE-2026-24686 go-tuf is a Go implementation of The Update Framework (TUF). Also affects tekton-chains
- CVE-2026-24137 sigstore framework is a common go library shared across sigstore services and clients. Also affects tekton-chains
- CVE-2026-24117 Rekor is a software supply chain transparency log. Also affects tekton-chains
- CVE-2026-23831 Rekor is a software supply chain transparency log. Also affects tekton-chains
- CVE-2026-23991 go-tuf is a Go implementation of The Update Framework (TUF). Also affects tekton-chains
- CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Also affects tekton-chains
- CVE-2026-22772 Fulcio is a certificate authority for issuing code signing certificates for an OpenID… Also affects tekton-chains