6.5

CVE-2026-25542: linuxfoundation tekton_pipelines Incorrect Regular Expression

CVSS: 6.5v3.1MediumModified
AliasesCGA-36wv-9c5c-vxjvCGA-3mrc-c495-ph4mCGA-4g34-78qg-42hc
Published 21-04-2026Last modified 22-05-2026
Open JSON

Vulnerability summary

CVE-2026-25542 is a medium (CVSS 6.5) Incorrect Regular Expression vulnerability in linuxfoundation tekton_pipelines. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · +0.12 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
OPENSUSE-SU-2026:21483-1CGA-HMRW-J52P-4JMV

Timeline

  1. 21-04-2026
    PublishedVulnerability first disclosed.
  2. 22-05-2026
    Last modifiedVulnerability information updated.

Description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

+0.12 pp

From 0.26% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Pipeline

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard164 products
  • tekton-chains< 0.27.0-r0
  • tekton-chains-fips< 0.27.0-r0
  • tekton-pipelines-controller-0.65All versions (No fix recorded)
  • tekton-pipelines-controller-0.68All versions (No fix recorded)
  • tekton-pipelines-controller-1.0< 1.0.2-r3
Wolfi18 products
  • tekton-chains< 0.27.0-r0
  • tekton-pipelines-controller-1.10All versions (No fix recorded)
  • tekton-pipelines-controller-1.9< 1.9.3-r2
  • tekton-pipelines-entrypoint-1.10All versions (No fix recorded)
  • tekton-pipelines-entrypoint-1.9< 1.9.3-r2
Github.com/tektoncd1 product
  • pipeline≥ 0.43.0, < 1.0.2 | ≥ 1.2.0, < 1.3.4 | ≥ 1.4.0, < 1.6.2 | ≥ 1.7.0, < 1.9.3 | ≥ 1.10.0, < 1.11.1
Linuxfoundation1 product
Tektoncd1 product
  • pipeline≥ 0.43.0, < 1.0.2 | ≥ 1.2.0, < 1.3.4 | ≥ 1.4.0, < 1.6.2 | ≥ 1.7.0, < 1.9.3 | ≥ 1.10.0, < 1.11.1

5 vendors · 185 products

References

7 links