CVE-2026-25542

{
  "id": "CVE-2026-25542",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T17:16:24.213",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue."
    },
    {
      "lang": "es",
      "value": "El proyecto Tekton Pipelines proporciona recursos estilo k8s para declarar pipelines estilo CI/CD. Desde 0.43.0 hasta 1.11.0, las políticas de verificación de recursos confiables comparan una cadena de origen de recurso (refSource.URI) contra spec.resources[].pattern utilizando regexp.MatchString. En Go, regexp.MatchString informa una coincidencia si el patrón coincide en cualquier parte de la cadena, por lo que los patrones comunes no anclados (incluidos ejemplos en la documentación de Tekton) pueden ser eludidos por cadenas de origen controladas por el atacante que contienen el patrón confiable como una subcadena. Esto puede causar una coincidencia de política no intencionada y cambiar qué modo/claves de verificación se aplican."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "tektoncd",
          "product": "pipeline",
          "versions": [
            {
              "version": ">= 0.43.0, < 1.0.2",
              "status": "affected"
            },
            {
              "version": ">= 1.2.0, < 1.3.4",
              "status": "affected"
            },
            {
              "version": ">= 1.4.0, < 1.6.2",
              "status": "affected"
            },
            {
              "version": ">= 1.7.0, < 1.9.3",
              "status": "affected"
            },
            {
              "version": ">= 1.10.0, < 1.11.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T16:48:04.873157Z",
          "id": "CVE-2026-25542",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-185"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*",
              "versionStartIncluding": "0.43.0",
              "versionEndExcluding": "1.11.0",
              "matchCriteriaId": "CBCD7D1F-1C53-41D3-B631-219678FDA581"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}