CVE-2026-25542
Linuxfoundation Tekton Pipelines 0.43.0 – 1.11.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2026-25542 is a medium-severity Incorrect Regular Expression (CWE-185) vulnerability in Linuxfoundation Tekton Pipelines. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Supply Chain (T1195.002); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24151
Vulnerability Data
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go,…
more
regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Bypass of trusted resource verification policies via regex substring matching directly enables compromise of the software supply chain by allowing untrusted/malicious pipeline resources to be accepted.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted input (refSource.URI) against policy patterns so that regexp substring matching bypasses are rejected.
Enforces the intended verification-mode and key decisions that the flawed policy match is currently allowing an attacker to subvert.
Implements information-flow rules that decide which resources may be processed; the broken regexp match undermines those flow decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct regex design, testing, and review to avoid improper matching.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect regex-related flaws before release.
Secure development lifecycle includes validation of input-handling constructs such as regex.
Application security requirements can mandate correct regex design and testing.
Secure coding standards directly address proper construction and review of regular expressions.