Description
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 0.43.0 to 1.11.0, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply.
INFO
Published Date :
2026-04-21T16:05:43.217Z
Last Modified :
2026-04-21T16:48:15.671Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25542 vulnerability.
| Vendors | Products |
|---|---|
| Tektoncd |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25542.
