Go/github.com/tektoncd/pipeline CVE-2026-33022: unknown, EPSS 0.46%
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline
Action: Upgrade github.com/tektoncd/pipeline to 1.0.1 or later.
go get github.com/tektoncd/pipeline@v1.0.1go get github.com/tektoncd/pipeline@v1.3.3go get github.com/tektoncd/pipeline@v1.6.1go get github.com/tektoncd/pipeline@v1.9.2go get github.com/tektoncd/pipeline@v1.10.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.60.0 | 1.0.1 | - |
| 1.1.0 | 1.3.3 | - |
| 1.4.0 | 1.6.1 | - |
| 1.7.0 | 1.9.2 | - |
| 1.10.0 | 1.10.2 | - |
Fixed versions
| 1.0.1 | 1.3.3 | 1.6.1 | 1.9.2 | 1.10.2 |
Sources
- osv: GO-2026-4730
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj
- https://github.com/tektoncd/pipeline/commit/5eead3f859b9
- https://github.com/tektoncd/pipeline/commit/01673237c464
- https://github.com/tektoncd/pipeline/commit/edc64bbf2232
- https://github.com/tektoncd/pipeline/commit/0fa2d66cff81
- https://github.com/tektoncd/pipeline/commit/5e4905fb6754
- https://github.com/tektoncd/pipeline/commit/ebc197e2b973
CVE-2026-33022 · published · modified · JSON