CVE-2026-33022

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or...

CVE-2026-33022

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or...

CVE-2026-33022

CVE-2026-33022 (Tekton Pipelines) causes a denial-of-service by allowing any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide when .spec.taskRef.resolver or .spec.pipelineRef.resolver is set to a 31+ character string. The crash stems from GenerateDeterministicName...

CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or...

CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or...

CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or...

Tekton Pipelines 输入验证错误漏洞

Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. Versions 0.60.0 to 1.0.0, 1.1.0 to 1.3.2, 1.4.0 to 1.6.0, 1.7.0 to 1.9.0, 1.10.0, and 1.10.1 of Tekton Pipelines contain an input validation vulnerability. This vulnerability arises from a parser name that is too long,...

CVE-2026-33211 vulnerabilities

Vulnerabilities for packages: tekton-chains, tekton-pipelines, tkn...

GHSA-J5Q5-J9GM-2W5C vulnerabilities

Vulnerabilities for packages: tekton-chains, tekton-pipelines, tkn...

GHSA-J5Q5-J9GM-2W5C vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn, tekton-chains-fips, tkn-fips...

CVE-2026-33211 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, tekton-chains, tekton-pipelines, tkn, tekton-chains-fips, tkn-fips...

GHSA-J5Q5-J9GM-2W5C Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

Summary The Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests e.g. by creating TaskRuns or PipelineRuns that use the git resolver can read arbitrary files from the resolver pod's filesystem, including...

Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

Summary The Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests e.g. by creating TaskRuns or PipelineRuns that use the git resolver can read arbitrary files from the resolver pod's filesystem, including...

GHSA-CV4X-93XX-WGFJ Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun

Summary A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver or .spec.pipelineRef.resolver to a string of 31 characters or more, causing a denial of service for all reconciliation. Details The controller...

Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun

Summary A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver or .spec.pipelineRef.resolver to a string of 31 characters or more, causing a denial of service for all reconciliation. Details The controller...

PT-2026-25993

Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 0.60.0 through 1.10.1 Description Tekton Pipelines is susceptible to a denial-of-service issue. A user with the ability to create TaskRun or PipelineRun resources can cause the Tekton Pipelines controller to crash by...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: nri-apache-fips, container-object-storage-interface-fips, kubernetes-dashboard-fips, amazon-cloudwatch-agent-operator-fips, crossplane-provider-aws-route53, dragonfly-operator, wave-fips, rancher-system-upgrade-controller, vault-env, promxy-fips, flagger,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, amazon-cloudwatch-agent-operator-fips, crossplane-provider-aws-route53, vault-env, promxy-fips, flagger, azure-aad-pod-identity-mic, emqx-exporter, k8s-metacollector-fips, temporal-ui-server-fips, octo-sts, emqx-exporter-fips,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: nri-apache-fips, container-object-storage-interface-fips, kubernetes-dashboard-fips, amazon-cloudwatch-agent-operator-fips, crossplane-provider-aws-route53, dragonfly-operator, wave-fips, rancher-system-upgrade-controller, vault-env, promxy-fips, flagger,...

GHSA-P436-GJF2-799P vulnerabilities

Vulnerabilities for packages: spire-server, tekton-pipelines, paranoia, manifest-tool, scorecard, vault-secrets-webhook, zot, kbld, witness, minio-operator, aactl, flux-notification-controller, tekton-chains, flux-kustomize-controller, rancher-fleet, vcluster, k9s, kubescape-operator, vitess, div...