CVE-2026-25542
Fixed in a distro release EPSS <1%CVSS 6.5
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Products: tektoncd pipeline
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/tektoncd/pipeline | 1.0.2 |
| Go | github.com/tektoncd/pipeline | 1.3.4 |
| Go | github.com/tektoncd/pipeline | 1.6.2 |
| Go | github.com/tektoncd/pipeline | 1.9.3 |
| Go | github.com/tektoncd/pipeline | 1.11.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | tekton-chains | 0.27.0-r0 |
| Chainguard | tekton-chains-fips | 0.27.0-r0 |
| Chainguard | tekton-pipelines-controller-0.65 | no fix |
| Chainguard | tekton-pipelines-controller-0.68 | no fix |
| Chainguard | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-controller-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-1.7 | no fix |
| Chainguard | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-controller-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-controller-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-controller-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-entrypoint-0.65 | no fix |
| Chainguard | tekton-pipelines-entrypoint-0.68 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-entrypoint-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.7 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-events-0.65 | no fix |
| Chainguard | tekton-pipelines-events-0.68 | no fix |
| Chainguard | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-1.10 | no fix |
| Chainguard | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-events-1.5 | no fix |
| Chainguard | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-1.7 | no fix |
| Chainguard | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-events-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-events-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-events-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-nop-0.65 | no fix |
| Chainguard | tekton-pipelines-nop-0.68 | no fix |
| Chainguard | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-nop-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-1.7 | no fix |
| Chainguard | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-nop-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-nop-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-nop-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-resolvers-0.65 | no fix |
| Chainguard | tekton-pipelines-resolvers-0.68 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-resolvers-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-1.7 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.65 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-0.68 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.7 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-webhook-0.65 | no fix |
| Chainguard | tekton-pipelines-webhook-0.68 | no fix |
| Chainguard | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-webhook-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-1.7 | no fix |
| Chainguard | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-webhook-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-webhook-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-workingdirinit-0.65 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-0.68 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-workingdirinit-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.7 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.9 | 1.9.3-r3 |
| Chainguard | tkn | 0.44.1-r4 |
| Chainguard | tkn-fips | 0.44.1-r4 |
| Wolfi | tekton-chains | 0.27.0-r0 |
| Wolfi | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-controller-1.10 | no fix |
| Wolfi | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-entrypoint-1.10 | no fix |
| Wolfi | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-events-1.10 | no fix |
| Wolfi | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-nop-1.10 | no fix |
| Wolfi | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-resolvers-1.10 | no fix |
| Wolfi | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Wolfi | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-webhook-1.10 | no fix |
| Wolfi | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-workingdirinit-1.10 | no fix |
| Wolfi | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Wolfi | tkn | 0.44.1-r4 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |