Read the docs
TI-2026-20651 Aliases CVE-2026-25542GHSA-rmx9-2pp3-xhcr

Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

Priority LOW 28CWE-185Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pipeline (tektoncd): 1.0.2, 1.3.4, 1.6.2 +2github.com/tektoncd/pipeline (Go): 1.0.2, 1.3.4, 1.6.2 +2Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagepipeline0.43.0 to before 1.0.2; 1.2.0 to before 1.3.4; 1.4.0 to before 1.6.2; 1.7.0 to before 1.9.3; 1.10.0 to before 1.11.11.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1Patch availableCNA
—github.com/tektoncd/pipeline (Go)0.43.0 to before 1.0.21.0.2Patch availableGHSA-rmx9-2pp3-xhcr
—github.com/tektoncd/pipeline (Go)1.2.0 to before 1.3.41.3.4Patch availableGHSA-rmx9-2pp3-xhcr
—github.com/tektoncd/pipeline (Go)1.4.0 to before 1.6.21.6.2Patch availableGHSA-rmx9-2pp3-xhcr
—github.com/tektoncd/pipeline (Go)1.7.0 to before 1.9.31.9.3Patch availableGHSA-rmx9-2pp3-xhcr
—github.com/tektoncd/pipeline (Go)1.10.0 to before 1.11.11.11.1Patch availableGHSA-rmx9-2pp3-xhcr
  • pipeline Vendorbackstage Affected 0.43.0 to before 1.0.2; 1.2.0 to before 1.3.4; 1.4.0 to before 1.6.2; 1.7.0 to before 1.9.3; 1.10.0 to before 1.11.1 Fixed in 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1 Patch available CNA
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 0.43.0 to before 1.0.2 Fixed in 1.0.2 Patch available GHSA-rmx9-2pp3-xhcr
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.2.0 to before 1.3.4 Fixed in 1.3.4 Patch available GHSA-rmx9-2pp3-xhcr
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.4.0 to before 1.6.2 Fixed in 1.6.2 Patch available GHSA-rmx9-2pp3-xhcr
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.7.0 to before 1.9.3 Fixed in 1.9.3 Patch available GHSA-rmx9-2pp3-xhcr
  • github.com/tektoncd/pipeline (Go) Vendor— Affected 1.10.0 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-rmx9-2pp3-xhcr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*0.43.0 to before 1.11.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:* Versions 0.43.0 to before 1.11.0 Vulnerable ·backstage

Remediation

  • Fix · CNA pipeline (tektoncd) Fixed in 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1
  • Fix · GHSA-rmx9-2pp3-xhcr github.com/tektoncd/pipeline (Go) Fixed in 1.0.2 Advisory →
  • Fix · GHSA-rmx9-2pp3-xhcr github.com/tektoncd/pipeline (Go) Fixed in 1.3.4 Advisory →
  • Fix · GHSA-rmx9-2pp3-xhcr github.com/tektoncd/pipeline (Go) Fixed in 1.6.2 Advisory →
  • Fix · GHSA-rmx9-2pp3-xhcr github.com/tektoncd/pipeline (Go) Fixed in 1.9.3 Advisory →
  • Fix · GHSA-rmx9-2pp3-xhcr github.com/tektoncd/pipeline (Go) Fixed in 1.11.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Builds for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Out of support scope
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Out of support scope
Red Hat Trusted Artifact SignerAffectedNo fix planned: Out of support scope
Not affected: 2 products
  • OpenShift Lightspeed
  • OpenShift Pipelines

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25542
  2. 2026-10-03 Alias added: GHSA-rmx9-2pp3-xhcr

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-29590 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVSS 3.1HIGH 8.5
  • TI-2026-29578 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2023-18894 Pipelines do not validate child UIDs CVSS 3.1MEDIUM 4.3
  • TI-2026-25632 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod CVSS 3.1CRITICAL 9.6
  • TI-2026-28976 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL CVSS 3.1HIGH 7.7
  • TI-2026-25468 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun CVSS 3.1MEDIUM 6.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences