CVE-2026-33022: Tekton Pipelines DOS Vulnerability

CVE-2026-33022 Overview

Tekton Pipelines, the Kubernetes-native CI/CD framework from the Linux Foundation, contains a denial-of-service vulnerability that allows any authenticated user with TaskRun or PipelineRun creation privileges to crash the controller cluster-wide. The vulnerability exists in the GenerateDeterministicNameFromSpec function, which produces resource names exceeding the 63-character DNS-1123 label limit when a resolver name of 31 or more characters is specified via .spec.taskRef.resolver or .spec.pipelineRef.resolver.

Critical Impact

A single malicious TaskRun or PipelineRun can crash the Tekton controller, causing CrashLoopBackOff and blocking all CI/CD reconciliation cluster-wide until manual intervention.

Affected Products

• Tekton Pipelines versions 0.60.0 through 1.0.0
• Tekton Pipelines versions 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0
• Tekton Pipelines versions 1.10.0 and 1.10.1

Discovery Timeline

• 2026-03-20 - CVE-2026-33022 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33022

Vulnerability Analysis

This denial-of-service vulnerability stems from improper array index validation in the name generation logic within Tekton Pipelines. When a user creates a TaskRun or PipelineRun with a custom resolver name containing 31 or more characters, the GenerateDeterministicNameFromSpec function generates a resource name that exceeds the Kubernetes DNS-1123 label limit of 63 characters.

The truncation logic within the function attempts to find a space character to split the generated name, but since the name contains no spaces, this results in a [-1] slice bound that causes a Go runtime panic. Once the controller crashes, it enters a CrashLoopBackOff state when it restarts because it immediately attempts to re-reconcile the offending resource, triggering the same panic repeatedly.

Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver with a name of 31+ characters triggers this bug.

Root Cause

The root cause is improper validation of array index bounds (CWE-129) in the GenerateDeterministicNameFromSpec function within pkg/resolution/resource/name.go. The function assumes that the generated name will contain a space character for truncation purposes, but this assumption fails when long resolver names produce names without spaces, resulting in an invalid negative index.

Attack Vector

The attack is network-accessible and requires only low-privilege access (the ability to create TaskRun or PipelineRun resources). An attacker can craft a malicious resource specification with a custom resolver name of 31+ characters:

# Example malicious TaskRun specification
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: malicious-taskrun
spec:
  taskRef:
    resolver: this-is-a-very-long-custom-resolver-name-exceeding-thirty-characters
    params:
      - name: name
        value: example-task

The security patch modifies the truncation logic in pkg/resolution/resource/name.go to truncate the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness:

 	"hash"
 	"hash/fnv"
 	"sort"
-	"strings"
 
 	v1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
 	"github.com/tektoncd/pipeline/pkg/apis/resolution/v1beta1"

Source: GitHub Commit

Detection Methods for CVE-2026-33022

Indicators of Compromise

• Tekton controller pods entering CrashLoopBackOff state repeatedly
• Controller logs showing Go runtime panics with "slice bounds out of range" errors in pkg/resolution/resource/name.go
• TaskRun or PipelineRun resources with unusually long custom resolver names (31+ characters)
• Sudden halt of all CI/CD pipeline reconciliation across the cluster

Detection Strategies

• Monitor Kubernetes pod status for tekton-pipelines-controller entering CrashLoopBackOff
• Implement admission controllers or OPA/Gatekeeper policies to validate resolver name length in TaskRun/PipelineRun specifications
• Set up alerting on controller pod restart counts exceeding normal thresholds
• Audit TaskRun and PipelineRun resources for suspicious resolver configurations

Monitoring Recommendations

• Configure Prometheus alerts for tekton-pipelines-controller pod restarts and CrashLoopBackOff events
• Enable detailed logging for the Tekton controller to capture panic stack traces
• Monitor Kubernetes events for controller crash and restart patterns
• Implement centralized log aggregation to correlate controller failures with specific resource creations

How to Mitigate CVE-2026-33022

Immediate Actions Required

• Upgrade to patched versions: 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2
• Audit existing TaskRun and PipelineRun resources for custom resolver names exceeding 30 characters
• Delete any malicious resources causing controller crashes before upgrading
• Implement RBAC restrictions to limit TaskRun/PipelineRun creation privileges to trusted users

Patch Information

The Linux Foundation has released security patches for all affected version branches. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. Patched versions include:

• Version 1.0.1 for the 1.0.x branch
• Version 1.3.3 for the 1.3.x branch
• Version 1.6.1 for the 1.6.x branch
• Version 1.9.2 for the 1.9.x branch
• Version 1.10.2 for the 1.10.x branch

For detailed patch information, see the GitHub Security Advisory GHSA-cv4x-93xx-wgfj and the security commit.

Workarounds

• Implement ValidatingAdmissionWebhook or OPA/Gatekeeper policies to reject TaskRun/PipelineRun resources with resolver names exceeding 30 characters
• Restrict RBAC permissions to limit which users can create TaskRun and PipelineRun resources
• Monitor and alert on controller crashes to enable rapid manual deletion of offending resources
• Avoid using custom resolvers with long names until patched versions are deployed

# Example: Find and delete potentially malicious TaskRuns with long resolver names
kubectl get taskruns -A -o json | jq -r '.items[] | select(.spec.taskRef.resolver != null) | select((.spec.taskRef.resolver | length) >= 31) | "\(.metadata.namespace)/\(.metadata.name)"'

# Delete offending resource to restore controller operation
kubectl delete taskrun <name> -n <namespace>