{"id":"CVE-2026-25542","title":"github.com/tektoncd/pipeline: Tekton Pipelines: Security bypass due to regular expression matching flaw (CVE-2026-25542)","summary":"A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the `regexp.MatchString` function in G…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":"CWE-625","vendor":"Red Hat","product":"OpenShift Pipelines","affected":["builds_for_red_hat_openshift","openshift_pipelines","openshift_serverless","openshift_ai_rhoai","openshift_virtualization 4","trusted_artifact_signer"],"patched":["github.com/tektoncd/pipeline 1.11.1"],"published":"2026-04-21","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:33:53+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25542.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25542.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-25542"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460159"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25542"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25542"},{"url":"https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a"},{"url":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr"},{"url":"https://github.com/tektoncd/pipeline/commit/2c398711e6e9e232180508f0648425a8ea34dc9e"},{"url":"https://github.com/tektoncd/pipeline/releases/tag/v1.11.0"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00264,"epssPercentile":0.18124,"aliases":["GO-2026-5630","GHSA-rmx9-2pp3-xhcr"],"ecosystem":"go","ingestedAt":"2026-07-24T19:07:03.318Z","slug":"CVE-2026-25542","body":"## Overview\n\nA flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the `regexp.MatchString` function in Go matching patterns anywhere within a string, rather than requiring an exact match. This vulnerability can lead to unintended policy matches, allowing an attacker to alter verification modes or keys and potentially compromise the integrity of Continuous Integration/Continuous Delivery (CI/CD) pipelines.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, Red Hat Trusted Artifact Signer · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, Red Hat Trusted Artifact Signer, Builds for Red Hat OpenShift, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25542.json)\n\n**github.com/tektoncd/pipeline: Tekton Pipelines: Security bypass due to regular expression matching flaw** — rated Moderate by Red Hat. Released 2026-04-21, updated 2026-10-15.\n\nAffected:\n\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Artifact Signer\n\nNo fix planned:\n\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Artifact Signer\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- OpenShift Serverless\n\nNot affected:\n\n- OpenShift Lightspeed\n- OpenShift Pipelines\n\n## Remediation\n\nOut of support scope\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-25542)\n\nAffected packages:\n\n- `github.com/tektoncd/pipeline >= 1.10.0, < 1.11.1`\n\nPatched in:\n\n- `github.com/tektoncd/pipeline 1.11.1`\n\nSource: https://osv.dev/vulnerability/GO-2026-5630","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222194,"id":"CVE-2026-25542","ts":1792065060589,"field":"cvss","old":null,"new":"6.5"},{"seq":222193,"id":"CVE-2026-25542","ts":1792065060589,"field":"severity","old":"none","new":"medium"}]}