CVE-2026-40924: Tekton Pipelines HTTP Resolver DOS Flaw

CVE-2026-40924 Overview

CVE-2026-40924 is a Denial of Service (DoS) vulnerability in Tekton Pipelines, a Kubernetes-native CI/CD pipeline framework. The vulnerability exists in the HTTP resolver's FetchHttpResource function, which fails to implement response body size limits when calling io.ReadAll(resp.Body). This allows authenticated tenants to trigger out-of-memory (OOM) conditions that crash the shared resolver pod, denying service to the entire Kubernetes cluster.

Critical Impact

Any tenant with permission to create TaskRuns or PipelineRuns can crash the tekton-pipelines-resolvers pod by pointing the HTTP resolver at a malicious server, causing cluster-wide CI/CD pipeline resolution failures and sustained crash loops.

Affected Products

• Tekton Pipelines versions prior to 1.11.1
• Deprecated pkg/resolution/resolver/http implementation
• Current pkg/remoteresolution/resolver/http implementation

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40924 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40924

Vulnerability Analysis

The vulnerability stems from a Resource Exhaustion flaw (CWE-400) in Tekton Pipelines' HTTP resolver component. When the resolver fetches remote resources via HTTP, it reads the entire response body into memory without implementing any size constraints. An attacker can exploit this by configuring a TaskRun or PipelineRun to reference a malicious HTTP endpoint that returns an extremely large response payload within the 1-minute timeout window.

The architectural design of Tekton Pipelines consolidates all resolver types—Git, Hub, Bundle, Cluster, and HTTP—into a single pod (tekton-pipelines-resolvers). This creates a single point of failure: when the HTTP resolver consumes excessive memory and triggers an OOM kill, all resolution capabilities for the entire cluster are disrupted simultaneously.

Root Cause

The root cause is the unsafe use of io.ReadAll(resp.Body) without implementing response size validation or streaming limits. The FetchHttpResource function blindly trusts and loads the complete HTTP response into memory, regardless of its size. This design flaw exists in both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http code paths, indicating the vulnerability was carried forward during refactoring.

Attack Vector

The attack requires network access and low-privilege authentication (permission to create TaskRuns or PipelineRuns). An attacker performs the following sequence:

1. Sets up an attacker-controlled HTTP server configured to return a very large response body (multiple gigabytes)
2. Creates a TaskRun or PipelineRun with an HTTP resolver reference pointing to the malicious server
3. The tekton-pipelines-resolvers pod attempts to fetch the resource and load the entire response into memory
4. The pod exceeds its memory limits and is OOM-killed by Kubernetes
5. The attacker can repeat this process to maintain a sustained crash loop, effectively denying CI/CD service to all cluster tenants

The vulnerability is particularly dangerous because a single malicious tenant can disrupt pipelines for all other tenants sharing the cluster.

Detection Methods for CVE-2026-40924

Indicators of Compromise

• Repeated OOM kill events for the tekton-pipelines-resolvers pod in Kubernetes logs
• Sudden memory spikes in resolver pod metrics immediately before crashes
• TaskRuns or PipelineRuns referencing unusual or external HTTP URLs
• High network ingress to the resolvers pod from unexpected external IPs

Detection Strategies

• Monitor Kubernetes events for OOMKilled status on the tekton-pipelines-resolvers pod
• Implement alerting on resolver pod restart counts exceeding baseline thresholds
• Audit TaskRun and PipelineRun specifications for HTTP resolver references to external or untrusted URLs
• Review HTTP resolver requests in network flow logs for abnormally large response sizes

Monitoring Recommendations

• Configure Prometheus alerts for memory utilization approaching limits on the resolvers pod
• Enable Kubernetes audit logging for TaskRun and PipelineRun creation events
• Implement network policies to restrict egress from resolver pods to approved endpoints only
• Set up pod disruption alerts to detect sustained crash loops in critical Tekton components

How to Mitigate CVE-2026-40924

Immediate Actions Required

• Upgrade Tekton Pipelines to version 1.11.1 or later immediately
• Review existing TaskRuns and PipelineRuns for HTTP resolver references to untrusted URLs
• Implement network policies to restrict HTTP resolver egress to known, trusted endpoints
• Consider temporarily disabling the HTTP resolver if not required for operations

Patch Information

The vulnerability is fixed in Tekton Pipelines version 1.11.1. The patch implements proper response body size limits in the HTTP resolver's FetchHttpResource function. Organizations should upgrade to 1.11.1 or later using their standard Kubernetes deployment methods.

For detailed patch information, refer to the GitHub Pipeline Release v1.11.1 and the GitHub Security Advisory GHSA-m2cx-gpqf-qf74.

Workarounds

• Restrict TaskRun and PipelineRun creation permissions to trusted users only using Kubernetes RBAC
• Implement network policies that whitelist only approved HTTP resolver target endpoints
• Deploy the HTTP resolver in a separate pod with strict resource limits to isolate failures
• Use alternative resolver types (Git, Bundle, Cluster) that do not rely on arbitrary HTTP endpoints

# Example: Apply resource limits to tekton-pipelines-resolvers deployment
kubectl patch deployment tekton-pipelines-resolvers -n tekton-pipelines --type='json' -p='[
  {
    "op": "add",
    "path": "/spec/template/spec/containers/0/resources/limits",
    "value": {
      "memory": "512Mi",
      "cpu": "500m"
    }
  }
]'