---
id: CVE-2026-25542
title: >-
  github.com/tektoncd/pipeline: Tekton Pipelines: Security bypass due to regular
  expression matching flaw (CVE-2026-25542)
summary: >-
  A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource
  verification policies by crafting a malicious source string that contains a
  trusted pattern as a substring. This is due to the `regexp.MatchString`
  function in G…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: vendor
cwe: CWE-625
vendor: Red Hat
product: OpenShift Pipelines
affected:
  - builds_for_red_hat_openshift
  - openshift_pipelines
  - openshift_serverless
  - openshift_ai_rhoai
  - openshift_virtualization 4
  - trusted_artifact_signer
patched:
  - github.com/tektoncd/pipeline 1.11.1
published: '2026-04-21'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:33:53+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25542.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25542.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-25542'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2460159'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-25542'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25542'
  - url: >-
      https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a
  - url: >-
      https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr
  - url: >-
      https://github.com/tektoncd/pipeline/commit/2c398711e6e9e232180508f0648425a8ea34dc9e
  - url: 'https://github.com/tektoncd/pipeline/releases/tag/v1.11.0'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00264
epssPercentile: 0.18331
aliases:
  - GO-2026-5630
  - GHSA-rmx9-2pp3-xhcr
ecosystem: go
ingestedAt: '2026-07-24T19:07:03.318Z'
---

## Overview

A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the `regexp.MatchString` function in Go matching patterns anywhere within a string, rather than requiring an exact match. This vulnerability can lead to unintended policy matches, allowing an attacker to alter verification modes or keys and potentially compromise the integrity of Continuous Integration/Continuous Delivery (CI/CD) pipelines.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, Red Hat Trusted Artifact Signer · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, Red Hat Trusted Artifact Signer, Builds for Red Hat OpenShift, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25542.json)

**github.com/tektoncd/pipeline: Tekton Pipelines: Security bypass due to regular expression matching flaw** — rated Moderate by Red Hat. Released 2026-04-21, updated 2026-10-15.

Affected:

- Builds for Red Hat OpenShift
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Virtualization 4
- Red Hat Trusted Artifact Signer

No fix planned:

- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Virtualization 4
- Red Hat Trusted Artifact Signer
- Builds for Red Hat OpenShift
- OpenShift Pipelines
- OpenShift Serverless

Not affected:

- OpenShift Lightspeed
- OpenShift Pipelines

## Remediation

Out of support scope

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-25542)

Affected packages:

- `github.com/tektoncd/pipeline >= 1.10.0, < 1.11.1`

Patched in:

- `github.com/tektoncd/pipeline 1.11.1`

Source: https://osv.dev/vulnerability/GO-2026-5630