{"action":"Upgrade github.com/tektoncd/pipeline to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0.60.0"},{"fixed":"1.3.3","introduced":"1.1.0"},{"fixed":"1.6.1","introduced":"1.4.0"},{"fixed":"1.9.2","introduced":"1.7.0"},{"fixed":"1.10.2","introduced":"1.10.0"}],"component":"github.com/tektoncd/pipeline","cve_ids":["CVE-2026-33022"],"ecosystem":"Go","epss":0.00375,"exploited":false,"fixed_versions":["1.0.1","1.3.3","1.6.1","1.9.2","1.10.2"],"ghsa_id":"GHSA-cv4x-93xx-wgfj","id":"tcs_01M5KF7W4P7XCPMVFWH3FT5TVB","modified_at":"2026-09-10T03:50:38.709503818Z","published_at":"2026-03-17T19:46:29Z","references":["https://osv.dev/vulnerability/GHSA-cv4x-93xx-wgfj","https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj","https://nvd.nist.gov/vuln/detail/CVE-2026-33022","https://github.com/tektoncd/pipeline/commit/01673237c464cfac7e286183f5c9e9d6ec951a64","https://github.com/tektoncd/pipeline/commit/0fa2d66cff814838c3a10cce252104c7fe618932","https://github.com/tektoncd/pipeline/commit/5e4905fb6754efa5ecea54de195738d73fb0e01d","https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6","https://github.com/tektoncd/pipeline/commit/ebc197e2b9733deedaa1624212ec66dcdf61eaaf","https://github.com/tektoncd/pipeline/commit/edc64bbf22323fcf218170f19047c9bcd8163e90","https://github.com/tektoncd/pipeline"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cv4x-93xx-wgfj","url":"https://osv.dev/vulnerability/GHSA-cv4x-93xx-wgfj"}],"summary":"Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun"}