CVE-2026-25542
published 2026-04-21CVE-2026-25542: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 0.43.0 to 1.11.0, trusted resources verification policies match…
medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 0.43.0 to 1.11.0, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply.
Affected
81 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| container-native-virtualization | kubevirt-ssp-operator-rhel9 | — | — |
| container-native-virtualization | kubevirt-tekton-tasks-create-datavolume-rhel9 | — | — |
| container-native-virtualization | kubevirt-tekton-tasks-disk-virt-customize-rhel9 | — | — |
| container-native-virtualization | kubevirt-template-validator-rhel9 | — | — |
| github.com | tektoncd_pipeline | >= 0.43.0 < 1.11.0 | 1.11.0 |
| linuxfoundation | tekton_pipelines | >= 0.43.0 < 1.11.0 | 1.11.0 |
| openshift-builds | openshift-builds-controller-rhel9 | — | — |
| openshift-builds | openshift-builds-git-cloner-rhel9 | — | — |
| openshift-builds | openshift-builds-image-bundler-rhel9 | — | — |
| openshift-builds | openshift-builds-image-processing-rhel9 | — | — |
| openshift-builds | openshift-builds-rhel9-operator | — | — |
| openshift-builds | openshift-builds-waiters-rhel9 | — | — |
| openshift-builds | openshift-builds-webhook-rhel9 | — | — |
| openshift-lightspeed | openshift-mcp-server-rhel9 | — | — |
| openshift-pipelines | pipelines-chains-controller-rhel8 | — | — |
| openshift-pipelines | pipelines-chains-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-cli-tkn-rhel8 | — | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-controller-rhel8 | — | — |
| openshift-pipelines | pipelines-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-entrypoint-rhel8 | — | — |
| openshift-pipelines | pipelines-entrypoint-rhel9 | — | — |
| openshift-pipelines | pipelines-events-rhel8 | — | — |
| openshift-pipelines | pipelines-events-rhel9 | — | — |
| openshift-pipelines | pipelines-git-init-rhel8 | — | — |