Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-25542 · Microsoft / collected KEV context

EUVD-2026-24151

GHSA-rmx9-2pp3-xhcr

GO-2026-5630

cve-program · CVE-2026-25542

• https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr
• https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a

euvd · EUVD-2026-24151

• https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr
• https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a

nvd · CVE-2026-25542

• https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a
• https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr

osv · GHSA-rmx9-2pp3-xhcr

• https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr
• https://nvd.nist.gov/vuln/detail/CVE-2026-25542
• https://github.com/tektoncd/pipeline/commit/2c398711e6e9e232180508f0648425a8ea34dc9e
• https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a
• https://github.com/tektoncd/pipeline
• https://github.com/tektoncd/pipeline/releases/tag/v1.11.0

osv · GO-2026-5630

• https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr
• https://github.com/tektoncd/pipeline/commit/2c398711e6e9e232180508f0648425a8ea34dc9e
• https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a
• https://github.com/tektoncd/pipeline/releases/tag/v1.11.0

No related operational record is retained in the current change model.