What is the CVSS score of CVE-2026-25542?

CVE-2026-25542 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-25542?

Yes, a patch is available for CVE-2026-25542. Update the affected software to the latest version immediately.

Tekton Pipelines CVE-2026-25542

EUVD-2026-24151 MEDIUM

Incorrect Regular Expression (CWE-185)

2026-04-21 GitHub_M

GHSA-rmx9-2pp3-xhcr

Authentication Bypass Kubernetes

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 21, 2026 - 20:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 16:59 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:30 euvd

EUVD-2026-24151

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVE Published

Apr 21, 2026 - 16:05 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 0.43.0 to 1.11.0, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern using regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the string, so common unanchored patterns (including examples in tekton documentation) can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This can cause an unintended policy match and change which verification mode/keys apply.

AnalysisAI

Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Authenticate to Kubernetes cluster

Delivery

Create malicious pipeline resource with crafted refSource.URI

Exploit

Submit resource containing trusted pattern as substring

Install

Regex engine matches unanchored pattern

System applies trusted verification mode

Execute

Inject unsigned or malicious code

Impact

Pipeline executes with elevated privileges

Recon

Authenticate to Kubernetes cluster

Delivery

Create malicious pipeline resource with crafted refSource.URI

Exploit

Submit resource containing trusted pattern as substring

Install

Regex engine matches unanchored pattern

System applies trusted verification mode

Execute

Inject unsigned or malicious code

Impact

Pipeline executes with elevated privileges

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) the attacker must have authenticated access to a Kubernetes cluster running vulnerable Tekton Pipelines (PR:L per CVSS), (2) the target organization must have configured trusted resource verification policies using spec.resources[].pattern with unanchored regular expressions (this is the default behavior encouraged by documentation examples), and (3) the attacker must have the ability to create or modify Tekton Pipeline resources (typical PipelineRun or Task definitions) with attacker-controlled refSource.URI values. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network-accessible, low-complexity exploitation requiring low authentication privileges with no user interaction, achieving high integrity impact within the same security scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated attacker with Kubernetes API access submits a malicious Tekton pipeline resource that references an attacker-controlled source URI constructed as 'https://attacker.com/trusted-pattern-substring-here/malicious-code'. The trusted resource verification policy contains an unanchored pattern such as 'trusted-pattern-substring' (common in documentation examples). …
Remediation	Upgrade Tekton Pipelines to version 1.12.0 or later, which includes the fix for unanchored regex matching in trusted resource verification policies. … Detailed patch versions, workarounds, and compensating controls in full report.