CVE-2026-25542

{"id": "CVE-2026-25542", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25542", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T16:48:04.873157Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tektoncd", "product": "pipeline", "versions": [{"status": "affected", "version": ">= 0.43.0, < 1.0.2"}, {"status": "affected", "version": ">= 1.2.0, < 1.3.4"}, {"status": "affected", "version": ">= 1.4.0, < 1.6.2"}, {"status": "affected", "version": ">= 1.7.0, < 1.9.3"}, {"status": "affected", "version": ">= 1.10.0, < 1.11.1"}]}]}], "published": "2026-04-21T17:16:24.213", "references": [{"url": "https://github.com/tektoncd/pipeline/commit/b8905600322aa86327baae0a7c04d6cf1207362a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-rmx9-2pp3-xhcr", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-185"}]}], "descriptions": [{"lang": "en", "value": "Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue."}, {"lang": "es", "value": "El proyecto Tekton Pipelines proporciona recursos estilo k8s para declarar pipelines estilo CI/CD. Desde 0.43.0 hasta 1.11.0, las pol\u00edticas de verificaci\u00f3n de recursos confiables comparan una cadena de origen de recurso (refSource.URI) contra spec.resources[].pattern utilizando regexp.MatchString. En Go, regexp.MatchString informa una coincidencia si el patr\u00f3n coincide en cualquier parte de la cadena, por lo que los patrones comunes no anclados (incluidos ejemplos en la documentaci\u00f3n de Tekton) pueden ser eludidos por cadenas de origen controladas por el atacante que contienen el patr\u00f3n confiable como una subcadena. Esto puede causar una coincidencia de pol\u00edtica no intencionada y cambiar qu\u00e9 modo/claves de verificaci\u00f3n se aplican."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "CBCD7D1F-1C53-41D3-B631-219678FDA581", "versionEndExcluding": "1.11.0", "versionStartIncluding": "0.43.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}