CVE-2026-25542: Tekton Pipelines regex bypass in trusted resources verification

CVE-2026-25542 · Severity: medium · CVSS 6.5 · Published 2026-04-21

Tekton Pipelines is a tool used to automate software building and deployment. A security flaw in how it verifies trusted resources allows an attacker to bypass security policies by using specially crafted web addresses. This could allow unauthorized code or resources to be used in a company's software delivery pipeline, potentially compromising the integrity of the software being built.

Technologies: github.com/tektoncd/pipeline (Go), Linuxfoundation Tekton Pipelines, Tekton Pipelines. Vendors: Go, Linuxfoundation, Tekton.

Quick answers

Is CVE-2026-25542 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25542 being exploited in the wild.
How severe is CVE-2026-25542?
Medium severity, with a CVSS score of 6.5, published 21 April 2026.
Which products and versions are affected?
github.com/tektoncd/pipeline (Go) >= 0.43.0, < 1.11.0, SEMVER:introduced=0.43.0,fixed=1.0.2, SEMVER:introduced=0.43.0,fixed=1.0.2,introduced=1.1.0,fixed=1.3.4,introduced=1.4.0,fixed=1.6.2,introduced=1.7.0,fixed=1.9.3,introduced=1.10.0,fixed=1.11.1; Tekton Pipelines >= 0.43.0, < 1.0.2; >= 1.2.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3; >= 1.10.0, < 1.11.1.
Is there a fix for CVE-2026-25542?
Yes. github.com/tektoncd/pipeline (Go): upgrade to 1.0.2, 1.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25542 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-25542?
Check whether you run github.com/tektoncd/pipeline (Go), Linuxfoundation Tekton Pipelines or Tekton Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/tektoncd/pipeline (Go): upgrade to 1.0.2, 1.11.1 or later
    go get github.com/tektoncd/pipeline@v1.11.1

Technical details

The vulnerability exists in the 'getMatchedPolicies' function within 'pkg/trustedresources/verify.go'. Tekton Pipelines uses Go's 'regexp.MatchString' to validate a resource's source URI (refSource.URI) against patterns defined in VerificationPolicies. Because 'regexp.MatchString' performs substring matching by default, unanchored patterns (e.g., 'github.com/tektoncd/catalog') can be satisfied by malicious URIs containing the trusted string as a substring (e.g., 'evil.com?ignore=github.com/tektoncd/catalog'). An attacker with low privileges can influence the source URI to bypass intended resource constraints and apply incorrect verification keys or modes. The fix involves stripping resolver prefixes and automatically anchoring patterns using non-capturing groups.

Affected products

  • TektonCD Tekton Pipelines >= 0.43.0, < 1.0.2; >= 1.1.0, < 1.3.4; >= 1.4.0, < 1.6.2; >= 1.7.0, < 1.9.3; >= 1.10.0, < 1.11.1

Identifiers

  • CVE-2026-25542
  • GHSA-rmx9-2pp3-xhcr
  • GO-2026-5630

Timeline

  • 2026-03-18: other: Fix commit authored
  • 2026-04-21: advisory: GHSA-rmx9-2pp3-xhcr published
  • 2026-04-21: patched: Fixes released in multiple versions
  • 2026-04-21: disclosed: CVE-2026-25542 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.