Executive brief
Tekton Pipelines is a tool used to automate software building and deployment. A security flaw in how it verifies trusted resources allows an attacker to bypass security policies by using specially crafted web addresses. This could allow unauthorized code or resources to be used in a company's software delivery pipeline, potentially compromising the integrity of the software being built.
Technical details
The vulnerability exists in the 'getMatchedPolicies' function within 'pkg/trustedresources/verify.go'. Tekton Pipelines uses Go's 'regexp.MatchString' to validate a resource's source URI (refSource.URI) against patterns defined in VerificationPolicies. Because 'regexp.MatchString' performs substring matching by default, unanchored patterns (e.g., 'github.com/tektoncd/catalog') can be satisfied by malicious URIs containing the trusted string as a substring (e.g., 'evil.com?ignore=github.com/tektoncd/catalog'). An attacker with low privileges can influence the source URI to bypass intended resource constraints and apply incorrect verification keys or modes. The fix involves stripping resolver prefixes and automatically anchoring patterns using non-capturing groups.
Affected products
- TektonCD Tekton Pipelines >= 0.43.0, < 1.0.2; >= 1.1.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3; >= 1.10.0, < 1.11.1
Timeline
- 2026-03-18: other: Fix commit authored
- 2026-04-21: advisory: GHSA-rmx9-2pp3-xhcr published
- 2026-04-21: patched: Fixes released in multiple versions
- 2026-04-21: disclosed: CVE-2026-25542 published