CVE-2026-33022: Tekton Pipelines DOS Vulnerability

CVE-2026-33022 Overview

Tekton Pipelines, the Kubernetes-native CI/CD framework from the Linux Foundation, contains a denial-of-service vulnerability that allows any authenticated user with TaskRun or PipelineRun creation privileges to crash the controller cluster-wide. The vulnerability exists in the GenerateDeterministicNameFromSpec function, which produces resource names exceeding the 63-character DNS-1123 label limit when a resolver name of 31 or more characters is specified via .spec.taskRef.resolver or .spec.pipelineRef.resolver.

Critical Impact
A single malicious TaskRun or PipelineRun can crash the Tekton controller, causing CrashLoopBackOff and blocking all CI/CD reconciliation cluster-wide until manual intervention.

Affected Products

Tekton Pipelines versions 0.60.0 through 1.0.0
Tekton Pipelines versions 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0
Tekton Pipelines versions 1.10.0 and 1.10.1

Discovery Timeline

2026-03-20 - CVE-2026-33022 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33022

Vulnerability Analysis

This denial-of-service vulnerability stems from improper array index validation in the name generation logic within Tekton Pipelines. When a user creates a TaskRun or PipelineRun with a custom resolver name containing 31 or more characters, the GenerateDeterministicNameFromSpec function generates a resource name that exceeds the Kubernetes DNS-1123 label limit of 63 characters.

The truncation logic within the function attempts to find a space character to split the generated name, but since the name contains no spaces, this results in a [-1] slice bound that causes a Go runtime panic. Once the controller crashes, it enters a CrashLoopBackOff state when it restarts because it immediately attempts to re-reconcile the offending resource, triggering the same panic repeatedly.

Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver with a name of 31+ characters triggers this bug.

Root Cause

The root cause is improper validation of array index bounds (CWE-129) in the GenerateDeterministicNameFromSpec function within pkg/resolution/resource/name.go. The function assumes that the generated name will contain a space character for truncation purposes, but this assumption fails when long resolver names produce names without spaces, resulting in an invalid negative index.

Attack Vector

The attack is network-accessible and requires only low-privilege access (the ability to create TaskRun or PipelineRun resources). An attacker can craft a malicious resource specification with a custom resolver name of 31+ characters:

yaml

# Example malicious TaskRun specification
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: malicious-taskrun
spec:
  taskRef:
    resolver: this-is-a-very-long-custom-resolver-name-exceeding-thirty-characters
    params:
      - name: name
        value: example-task

The security patch modifies the truncation logic in pkg/resolution/resource/name.go to truncate the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness:

 	"hash"
 	"hash/fnv"
 	"sort"
-	"strings"
 
 	v1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
 	"github.com/tektoncd/pipeline/pkg/apis/resolution/v1beta1"

Source: GitHub Commit

Detection Methods for CVE-2026-33022

Indicators of Compromise

Tekton controller pods entering CrashLoopBackOff state repeatedly
Controller logs showing Go runtime panics with "slice bounds out of range" errors in pkg/resolution/resource/name.go
TaskRun or PipelineRun resources with unusually long custom resolver names (31+ characters)
Sudden halt of all CI/CD pipeline reconciliation across the cluster

Detection Strategies

Monitor Kubernetes pod status for tekton-pipelines-controller entering CrashLoopBackOff
Implement admission controllers or OPA/Gatekeeper policies to validate resolver name length in TaskRun/PipelineRun specifications
Set up alerting on controller pod restart counts exceeding normal thresholds
Audit TaskRun and PipelineRun resources for suspicious resolver configurations

Monitoring Recommendations

Configure Prometheus alerts for tekton-pipelines-controller pod restarts and CrashLoopBackOff events
Enable detailed logging for the Tekton controller to capture panic stack traces
Monitor Kubernetes events for controller crash and restart patterns
Implement centralized log aggregation to correlate controller failures with specific resource creations

How to Mitigate CVE-2026-33022

Immediate Actions Required

Upgrade to patched versions: 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2
Audit existing TaskRun and PipelineRun resources for custom resolver names exceeding 30 characters
Delete any malicious resources causing controller crashes before upgrading
Implement RBAC restrictions to limit TaskRun/PipelineRun creation privileges to trusted users

Patch Information

The Linux Foundation has released security patches for all affected version branches. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. Patched versions include:

Version 1.0.1 for the 1.0.x branch
Version 1.3.3 for the 1.3.x branch
Version 1.6.1 for the 1.6.x branch
Version 1.9.2 for the 1.9.x branch
Version 1.10.2 for the 1.10.x branch

For detailed patch information, see the GitHub Security Advisory GHSA-cv4x-93xx-wgfj and the security commit.

Workarounds

Implement ValidatingAdmissionWebhook or OPA/Gatekeeper policies to reject TaskRun/PipelineRun resources with resolver names exceeding 30 characters
Restrict RBAC permissions to limit which users can create TaskRun and PipelineRun resources
Monitor and alert on controller crashes to enable rapid manual deletion of offending resources
Avoid using custom resolvers with long names until patched versions are deployed

bash

# Example: Find and delete potentially malicious TaskRuns with long resolver names
kubectl get taskruns -A -o json | jq -r '.items[] | select(.spec.taskRef.resolver != null) | select((.spec.taskRef.resolver | length) >= 31) | "\(.metadata.namespace)/\(.metadata.name)"'

# Delete offending resource to restore controller operation
kubectl delete taskrun <name> -n <namespace>