Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M
CVE-2026-25542Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
Medium 6.5
In plain English
A medium-severity security flaw in pipeline from tektoncd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/tektoncd/pipeline | 1.0.2 | GHSA-rmx9-2pp3-xhcr |
| Go | github.com/tektoncd/pipeline | 1.3.4 | GHSA-rmx9-2pp3-xhcr |
| Go | github.com/tektoncd/pipeline | 1.6.2 | GHSA-rmx9-2pp3-xhcr |
| Go | github.com/tektoncd/pipeline | 1.9.3 | GHSA-rmx9-2pp3-xhcr |
| Go | github.com/tektoncd/pipeline | 1.11.1 | GHSA-rmx9-2pp3-xhcr |
| Go | github.com/tektoncd/pipeline | 1.0.2, 1.11.1, 1.3.4, 1.6.2, 1.9.3 | GO-2026-5630 |
Affected products (as reported)
Weakness: CWE-185 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N