tektoncd pipeline up to 1.10.1 array index

Summaryinfo

A vulnerability was found in tektoncd pipeline up to 1.0.0/1.3.2/1.6.0/1.9.1/1.10.1. It has been classified as problematic. The impacted element is an unknown function. The manipulation leads to array index. This vulnerability is uniquely identified as CVE-2026-33022. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in tektoncd pipeline up to 1.0.0/1.3.2/1.6.0/1.9.1/1.10.1. It has been rated as problematic. This issue affects an unknown code block. The manipulation with an unknown input leads to a array index vulnerability. Using CWE to declare the problem leads to CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. Impacted is availability. The summary by CVE is:

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33022 since 03/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.0.1, 1.3.3, 1.6.1, 1.9.2 or 1.10.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1249). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Red Hat OpenShift

Productinfo

Vendor

• tektoncd

Name

• pipeline

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.3.0
• 1.3.1
• 1.3.2
• 1.4
• 1.5
• 1.6.0
• 1.9.0
• 1.9.1
• 1.10.0
• 1.10.1

Website

• Product: https://github.com/tektoncd/pipeline/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion