{"id":"EUVD-2026-24151","enisaUuid":"dc009500-bb0a-318e-8e5c-127ecf4618b2","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","datePublished":"Apr 21, 2026, 4:05:43 PM","dateUpdated":"May 22, 2026, 4:06:24 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr\nhttps://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a\n","aliases":"CVE-2026-25542\nGHSA-rmx9-2pp3-xhcr\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"12c95f45-70c1-3412-a66b-0ffc296fab5a","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"0.43.0, \u003c 1.0.2"},{"id":"28659057-6276-3151-8155-e37bfc1a3a6f","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.7.0, \u003c 1.9.3"},{"id":"29788740-eaab-3fbe-aa28-1226cc8bce9d","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.10.0, \u003c 1.11.1"},{"id":"aac77a79-a6b6-3f3d-bb67-2241b8677349","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.4.0, \u003c 1.6.2"},{"id":"ae2fee36-478c-36a3-8e52-bf30a1921599","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.2.0, \u003c 1.3.4"}],"enisaIdVendor":[{"id":"17d8c190-93a7-311a-a2a8-d1d17974a217","vendor":{"name":"tektoncd"}}],"enisaIdVulnerability":[{"id":"1d5ad418-e35f-3b19-b9c2-b1a13dd8367f","vulnerability":{"id":"CVE-2026-25542","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","datePublished":"Apr 21, 2026, 4:05:43 PM","dateUpdated":"May 22, 2026, 4:06:24 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr\nhttps://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a\n","enisa_id":"EUVD-2026-24151\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 1, 2026, 4:00:15 AM","vulnerabilityProduct":[{"id":"23f5f874-4019-3276-876c-03458305d436","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.2.0, \u003c 1.3.4"},{"id":"4e39ea4a-45a5-38b0-b353-cd159a39759d","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.4.0, \u003c 1.6.2"},{"id":"81ae7f72-8c55-3724-97c5-7b6a97a3848b","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.10.0, \u003c 1.11.1"},{"id":"a2ec3c70-f08f-3289-b9c9-2e40892fd660","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"1.7.0, \u003c 1.9.3"},{"id":"bc0a03f4-66ba-3bb7-ac0b-09cc9b289441","product":{"name":"pipeline","vendor":{"name":"tektoncd"}},"product_version":"0.43.0, \u003c 1.0.2"}],"vulnerabilityVendor":[{"id":"92456aae-7dc0-3402-8a1f-4d7859920961","vendor":{"name":"tektoncd"}}]}},{"id":"465163c0-dcb1-3d77-afd5-04d34f98b468","vulnerability":{"id":"GHSA-rmx9-2pp3-xhcr","description":"Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching","datePublished":"Apr 21, 2026, 4:25:19 PM","dateUpdated":"May 22, 2026, 4:05:24 PM","baseScore":0.0,"references":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25542\nhttps://github.com/tektoncd/pipeline/commit/2c398711e6e9e232180508f0648425a8ea34dc9e\nhttps://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a\nhttps://github.com/tektoncd/pipeline\nhttps://github.com/tektoncd/pipeline/releases/tag/v1.11.0\n","enisa_id":"EUVD-2026-24151\n","aliases":"CVE-2026-25542\nGHSA-rmx9-2pp3-xhcr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}