Vulnerability in Tekton Pipelines Affects Source Verification in CI/CD Processes

CVE-2026-25542

What is CVE-2026-25542?

The Tekton Pipelines project has a vulnerability where trusted resources verification policies can be manipulated through attacker-controlled source strings. Specifically, from versions 0.43.0 to 1.11.0, the verification process matches source strings using regex patterns that can be compromised. The use of unanchored regex patterns allows these patterns to match substrings within source strings, leading to unintended policy matches. This discrepancy can disrupt the intended verification modes and keys, jeopardizing the security of CI/CD pipelines.

References