Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. This issue has been patched in versions 1.0.1, 1.3.3, 1.6.1, 1.9.2 and 1.10.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tektoncd | pipeline | >= 0.60.0, < 1.0.1, >= 1.1.0, < 1.3.3, >= 1.4.0, < 1.6.1, >= 1.7.0, < 1.9.2, >= 1.10.0, < 1.10.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260326T203309-150000.1.155.2 | SUSE-SU-2026:1135-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | tekton-chains | 0.26.2-r5 | — |
| Wolfi rolling | tkn | 0.44.0-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/tektoncd/pipeline | >= 0.60.0, < 1.0.1 | 1.0.1 | GHSA-cv4x-93xx-wgfj |
| Go | github.com/tektoncd/pipeline | >= 1.1.0, < 1.3.3 | 1.3.3 | GHSA-cv4x-93xx-wgfj |
| Go | github.com/tektoncd/pipeline | >= 1.4.0, < 1.6.1 | 1.6.1 | GHSA-cv4x-93xx-wgfj |
| Go | github.com/tektoncd/pipeline | >= 1.7.0, < 1.9.2 | 1.9.2 | GHSA-cv4x-93xx-wgfj |
| Go | github.com/tektoncd/pipeline | >= 1.10.0, < 1.10.2 | 1.10.2 | GHSA-cv4x-93xx-wgfj |
| Go | github.com/tektoncd/pipeline | >= 0.60.0, < 1.0.1 · >= 1.1.0, < 1.3.3 · >= 1.4.0, < 1.6.1 · >= 1.7.0, < 1.9.2 · >= 1.10.0, < 1.10.2 | 1.0.1, 1.3.3, 1.6.1, 1.9.2, 1.10.2 | GO-2026-4730 |
Advisories 3
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- WID-SEC-2026-1249 Red Hat OpenShift Pipelines: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 8, 2026
- SUSE-SU-2026:1135-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 31, 2026