CVE-2026-25542

hey guys,

triage contract
this is a first-screen summary; deterministic proof is in the proof bundle (canonical.log/control.log/witness.txt).

summary
trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. in go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. this can cause an unintended policy match and change which verification mode/keys apply.

pins

• repo: https://github.com/tektoncd/pipeline
• commit: 0133513db03dadb3cb08801d6b0330badcb63830
• callsite: pkg/trustedresources/verify.go:118-137 (getMatchedPolicies)

severity
MEDIUM (provisional CVSS 5.3–6.5) (signing request tampering)

repro (canonical)

• command: unzip -q -o poc.zip -d poc && cd poc/poc-F-TEKTON-REGEX-001 && make canonical
• expected: cap not reached; canonical does not emit the vulnerability markers.
• actual: cap reached; canonical emits the vulnerability markers.
• canonical markers (mandatory): [CALLSITE_HIT] + [PROOF_MARKER]

negative control

• command: unzip -q -o poc.zip -d poc && cd poc/poc-F-TEKTON-REGEX-001 && make control
• expected: cap not reached under the same harness; control emits the control marker and does not emit the vulnerability markers.
• control markers (mandatory): [CALLSITE_HIT] + [NC_MARKER]

fix
consider making matching safe-by-default by requiring full-string matches (or validating patterns and documenting substring semantics clearly). one option is to anchor patterns before matching (e.g., wrap pattern as ^(?:pattern)$ when not already anchored), or to provide a separate field for exact match vs regex match.
fix accepted when: under the same harness, canonical still hits [CALLSITE_HIT] but does not emit [PROOF_MARKER].

proof bundle pointers

• bundle: poc.zip
• bundle convention: zip extracts under a single top-level folder (poc-F-TEKTON-REGEX-001/) to avoid collisions
• contains: canonical.log, control.log, witness.txt
• extracted paths: after extraction, see ./poc/poc-F-TEKTON-REGEX-001/canonical.log, ./poc/poc-F-TEKTON-REGEX-001/control.log, ./poc/poc-F-TEKTON-REGEX-001/witness.txt
• verify: compare shasum -a 256 for canonical.log/control.log/fix.patch/test source against witness.txt
• supported-mode note: if your supported integration uses verified https app-links/universal links only, provide the supported tag/branch and we can retest on that pin.

poc.zip

impact
an attacker can craft a trusted resources source string that embeds a trusted substring and still matches an unanchored verificationpolicy spec.resources[].pattern, even if the policy is intended to constrain matches to a specific trusted source. this occurs because regexp.MatchString succeeds on substring matches, so patterns like https://github.com/tektoncd/catalog.git match attacker-controlled sources such as https://evil.com/?x=https://github.com/tektoncd/catalog.git.

affected: deployments using trusted resources verification with unanchored verificationpolicy patterns, where an attacker can influence the refSource.URI value used for policy matching.

not affected: deployments that anchor all patterns (^...$) or otherwise enforce full-string matching; deployments where attackers cannot influence refSource.URI.

steps to reproduce

unzip -q -o poc.zip -d /tmp/poc-tekton-regex-001
cd /tmp/poc-tekton-regex-001/poc-F-TEKTON-REGEX-001
bash ./run.sh canonical | tee /tmp/tekton-regex-001-canonical.log
bash ./run.sh control | tee /tmp/tekton-regex-001-control.log
grep -n '\\[PROOF_MARKER\\]' /tmp/tekton-regex-001-canonical.log && grep -n '\\[NC_MARKER\\]' /tmp/tekton-regex-001-control.log && ! grep -n '\\[PROOF_MARKER\\]' /tmp/tekton-regex-001-control.log

suggested patch options:

• make matching safe-by-default by anchoring patterns before matching (or by validating and rejecting unanchored patterns).
• document the substring semantics explicitly and update documentation examples to include anchors.

workarounds
anchor verificationpolicy resource patterns so they must match the full source string. example:

• ^https://github.com/tektoncd/catalog\\.git$

best,
oleh

CVE-2026-25542 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-25542? CVE-2026-25542 is a medium-severity security vulnerability in github.com/tektoncd/pipeline (go), affecting versions >= 0.43.0, < 1.0.2. It is fixed in 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1.
2. How severe is CVE-2026-25542? CVE-2026-25542 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/tektoncd/pipeline are affected by CVE-2026-25542? github.com/tektoncd/pipeline (go) versions >= 0.43.0, < 1.0.2 is affected.
4. Is there a fix for CVE-2026-25542? Yes. CVE-2026-25542 is fixed in 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1. Upgrade to this version or later.
5. Is CVE-2026-25542 exploitable, and should I be worried? Whether CVE-2026-25542 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-25542 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-25542?
   • Upgrade github.com/tektoncd/pipeline to 1.0.2 or later
   • Upgrade github.com/tektoncd/pipeline to 1.3.4 or later
   • Upgrade github.com/tektoncd/pipeline to 1.6.2 or later
   • Upgrade github.com/tektoncd/pipeline to 1.9.3 or later
   • Upgrade github.com/tektoncd/pipeline to 1.11.1 or later