VDB
RHSA-2026%3A10026
RHSA-2026%3A10026
PUBLISHED
CVSS 6.5 MEDIUM
A denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:8f076dc87af9322a285f6ce4b434f2cd073377e0ea4d15ba176ba1d4d61d4cc4_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel9@sha256:224b368e30c016813b6ef8207c2315c63691fa79028c743d8f7560ce74e71342_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel9@sha256:224b368e30c016813b6ef8207c2315c63691fa79028c743d8f7560ce74e71342_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel9@sha256:ea970597dd190a8ccf2cf9b79cd176c82be380fe6a268258b2a601f20363cced_s390x as a component of Red Hat OpenShift Pipelines 1.2 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-operator-webhook-rhel9@sha256:6fc77db6045a62215c6b2c87ab9f7ac3892e381c645f2e78032d2788f83ca729_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:2ae1ad50f3f8eba2609774e7c98eab3d1791418e30e2fcf2483942d375cb0605_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:2ae1ad50f3f8eba2609774e7c98eab3d1791418e30e2fcf2483942d375cb0605_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:0caa7da1dc4d9bc97469d87db226f8e9117afc243f016ec007e63a499eacd885_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:0caa7da1dc4d9bc97469d87db226f8e9117afc243f016ec007e63a499eacd885_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:c55963aca692a6168530a5d83e2c714551bb834e028ccef73244c0392693f3c6_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:c55963aca692a6168530a5d83e2c714551bb834e028ccef73244c0392693f3c6_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel9@sha256:3cee08eb6f0c9ee6fb7b56ed7267d3027e15cde7d53f451a767b66a8800e39a1_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel9@sha256:3cee08eb6f0c9ee6fb7b56ed7267d3027e15cde7d53f451a767b66a8800e39a1_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:9af4e1edc9678b88a1b8b6d0561f48ac1b47a12f27e9595ec5141dbbcd334aec_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:2c2edaec3cd60796aea7c45ffeb74abe06d81c6c32c2bfdb868ed5752540f975_s390x as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:2c2edaec3cd60796aea7c45ffeb74abe06d81c6c32c2bfdb868ed5752540f975_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel9@sha256:54331cfda3badd4bdf26c5b331d8af3ec77f2c9691544de7083e299029016c95_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel9@sha256:54331cfda3badd4bdf26c5b331d8af3ec77f2c9691544de7083e299029016c95_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel9@sha256:551a03f31896276a4ec691fa64593177ff24e3c68a7922710fada541d50ae99b_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel9@sha256:551a03f31896276a4ec691fa64593177ff24e3c68a7922710fada541d50ae99b_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9@sha256:6ec8e91be151109a106f698be9e3f44199a0efeea8bfb4b7bf6311be8e519af6_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9@sha256:6ec8e91be151109a106f698be9e3f44199a0efeea8bfb4b7bf6311be8e519af6_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:962a077137ca959e185b8f51c1ab9288cdf4be9dafa74a622e7dfeda65f431b0_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9@sha256:962a077137ca959e185b8f51c1ab9288cdf4be9dafa74a622e7dfeda65f431b0_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:e099d31b04aec0af0f3f28bdcb989640d4ef4cf58e2ab136585f93ebce9ee3fa_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel9@sha256:e099d31b04aec0af0f3f28bdcb989640d4ef4cf58e2ab136585f93ebce9ee3fa_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel9@sha256:b8638d20ab3983f546b60055b91e4f8bd794a1cbae2ea4c30ab4d5fb8462908d_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel9@sha256:b8638d20ab3983f546b60055b91e4f8bd794a1cbae2ea4c30ab4d5fb8462908d_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel9@sha256:766dfe16f97601fada3f433cb49ec0972dd2a8291f1916ac930055b973a280ff_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:2f461c99cdcedaaf99b7313d0302ad20baab9fcae545d844ba59fc26618777a5_amd64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9@sha256:2f461c99cdcedaaf99b7313d0302ad20baab9fcae545d844ba59fc26618777a5_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:a1011341b0fbd4d337ba3f29322c490e0d2c3ded18725a5ae62c1047a78c5681_arm64 as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9@sha256:a1011341b0fbd4d337ba3f29322c490e0d2c3ded18725a5ae62c1047a78c5681_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-sidecarlogresults-rhel9@sha256:310afa55b5ba2d3058fb1e4e532c56464b30faf2fa23296583d8e20925d0c859_ppc64le as a component of Red Hat OpenShift Pipelines 1.2 | registry.redhat.io/openshift-pipelines/pipelines-sidecarlogresults-rhel9@sha256:310afa55b5ba2d3058fb1e4e532c56464b30faf2fa23296583d8e20925d0c859_ppc64le |
…and 84 more
Timeline
- Apr 23, 2026 CVE Published
- Apr 28, 2026 CVE Updated
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:10026 advisory
- https://access.redhat.com/security/cve/CVE-2026-33022 advisory
- https://access.redhat.com/security/cve/CVE-2026-33211 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10026.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2449483 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33022 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33022 advisory
- https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6 advisory
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2450554 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33211 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33211 advisory
- https://github.com/tektoncd/pipeline/commit/10fa538f9a2b6d01c75138f1ed7ba3da0e34687c advisory
- https://github.com/tektoncd/pipeline/commit/318006c4e3a5 advisory
- https://github.com/tektoncd/pipeline/commit/3ca7bc6e6dd1d97f80b84f78370d91edaf023cbd advisory
- https://github.com/tektoncd/pipeline/commit/961388fcf3374bc7656d28ab58ca84987e0a75ae advisory
- https://github.com/tektoncd/pipeline/commit/b1fee65b88aa969069c14c120045e97c37d9ee5e advisory
- https://github.com/tektoncd/pipeline/commit/cdb4e1e97a4f3170f9bc2cbfff83a6c8107bc3db advisory
…and 2 more