{"action":"Upgrade github.com/tektoncd/pipeline to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0.60.0"},{"fixed":"1.3.3","introduced":"1.1.0"},{"fixed":"1.6.1","introduced":"1.4.0"},{"fixed":"1.9.2","introduced":"1.7.0"},{"fixed":"1.10.2","introduced":"1.10.0"}],"component":"github.com/tektoncd/pipeline","cve_ids":["CVE-2026-33022"],"ecosystem":"Go","epss":0.00463,"exploited":false,"fixed_versions":["1.0.1","1.3.3","1.6.1","1.9.2","1.10.2"],"ghsa_id":"GHSA-cv4x-93xx-wgfj","id":"tcs_01M5KGFM1PBPSBDS65JMB4AFHE","modified_at":"2026-07-23T19:15:15.711765333Z","published_at":"2026-03-23T18:14:47Z","references":["https://osv.dev/vulnerability/GO-2026-4730","https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj","https://github.com/tektoncd/pipeline/commit/5eead3f859b9","https://github.com/tektoncd/pipeline/commit/01673237c464","https://github.com/tektoncd/pipeline/commit/edc64bbf2232","https://github.com/tektoncd/pipeline/commit/0fa2d66cff81","https://github.com/tektoncd/pipeline/commit/5e4905fb6754","https://github.com/tektoncd/pipeline/commit/ebc197e2b973"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4730","url":"https://osv.dev/vulnerability/GO-2026-4730"}],"summary":"Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline"}