PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25542 tektoncd CVE debrief

Tekton Pipelines has a policy-matching flaw in trusted resources verification. In affected versions, a source string is checked with regexp.MatchString against spec.resources[].pattern, and Go regex matching succeeds on substrings unless patterns are anchored. As a result, an attacker-controlled source URI can contain a trusted pattern as a substring and trigger the wrong verification policy, changing which verification mode and keys are used. The issue is recorded as CVE-2026-25542 with medium CVSS (6.5) and a CWE-185 classification.

Vendor
tektoncd
Product
pipeline
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-21
Original CVE updated
2026-05-01
Advisory published
2026-04-21
Advisory updated
2026-05-01

Who should care

Teams operating Tekton Pipelines, especially anyone using trusted resource verification policies, regex-based resource patterns, or supply-chain controls in CI/CD pipelines.

Technical summary

The vulnerability affects Tekton Pipelines from 0.43.0 through 1.11.0. Policy selection compares refSource.URI to spec.resources[].pattern via regexp.MatchString. Because MatchString searches for a match anywhere in the string, unanchored patterns can be satisfied by a substring inside an attacker-controlled URI. That can cause an unintended trusted-resource policy match and alter the verification behavior applied to the resource.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade Tekton Pipelines to a fixed release containing commit b8905600322aa86327baae0a7c04d6cf1207362a or later.
  • Review all trusted resource patterns and anchor regexes so they match the full intended URI rather than substrings.
  • Re-test verification policies against representative attacker-controlled and malformed source strings.
  • Audit any pipelines that rely on trusted resource verification to confirm the intended keys and modes are selected.
  • Track the vendor advisory GHSA-rmx9-2pp3-xhcr and the NVD record for remediation guidance.

Evidence notes

The CVE and NVD record identify affected versions 0.43.0–1.11.0, the use of regexp.MatchString in policy matching, and CWE-185. Official references include the Tekton patch commit b8905600322aa86327baae0a7c04d6cf1207362a and the vendor advisory GHSA-rmx9-2pp3-xhcr. The CVE was published on 2026-04-21 and modified on 2026-05-01.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25542 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25542

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25542 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25542

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.