PT-2026-34001 · Go+1 · Github.Com/Tektoncd/Pipeline+1

Published

2026-04-21

·

Updated

2026-04-21

·

CVE-2026-25542

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

The Trusted Resources verification system matches a resource source string (refSource.URI) against spec.resources[].pattern using Go's regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the input string. As a result, common unanchored patterns—including examples found in Tekton documentation—can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This may cause an unintended policy match and alter which verification mode or keys are applied.

Affected Component

Impact

An attacker can craft a Trusted Resources source string that embeds a trusted substring and still matches an unanchored VerificationPolicy spec.resources[].pattern, even if the policy is intended to constrain matches to a specific trusted source. This occurs because regexp.MatchString succeeds on substring matches. For example, a pattern such as https://github.com/tektoncd/catalog.git would match an attacker-controlled source like https://evil.com/?x=https://github.com/tektoncd/catalog.git.
Affected: Deployments using Trusted Resources verification with unanchored VerificationPolicy patterns, where an attacker can influence the refSource.URI value used for policy matching.
Not affected: Deployments that anchor all patterns (^...$) or otherwise enforce full-string matching; deployments where attackers cannot influence refSource.URI.

Reproduction

Canonical (Demonstrates Vulnerability)

unzip -q -o poc.zip -d /tmp/poc-tekton-regex-001
cd /tmp/poc-tekton-regex-001/poc-F-TEKTON-REGEX-001
bash ./run.sh canonical | tee /tmp/tekton-regex-001-canonical.log
  • Expected (secure): Capability not reached; canonical does not emit vulnerability markers.
  • Actual (vulnerable): Capability reached; canonical emits vulnerability markers.
  • Canonical markers (mandatory): [CALLSITE HIT] + [PROOF MARKER]

Negative Control

bash ./run.sh control | tee /tmp/tekton-regex-001-control.log
  • Expected: Capability not reached under the same harness; control emits the control marker and does not emit vulnerability markers.
  • Control markers (mandatory): [CALLSITE HIT] + [NC MARKER]

Verification

grep -n '[PROOF MARKER]' /tmp/tekton-regex-001-canonical.log 
 && grep -n '[NC MARKER]' /tmp/tekton-regex-001-control.log 
 && ! grep -n '[PROOF MARKER]' /tmp/tekton-regex-001-control.log

Suggested Fix

It is recommended to make matching safe-by-default by requiring full-string matches, or by validating patterns and clearly documenting substring semantics. Possible approaches include:
  1. Anchor patterns before matching — e.g., wrap pattern as ^(?:pattern)$ when not already anchored.
  2. Introduce a separate field for exact match vs. regex match semantics.
  3. Document substring semantics explicitly and update all documentation examples to include anchors.
A fix is considered accepted when, under the same harness, the canonical test still hits [CALLSITE HIT] but does not emit [PROOF MARKER].

Workarounds

Anchor all VerificationPolicy resource patterns so they must match the full source string. For example:
pattern: "^https://github.com/tektoncd/catalog.git$"

Proof Bundle

  • Bundle: poc.zip
  • Convention: The zip extracts under a single top-level folder (poc-F-TEKTON-REGEX-001/) to avoid collisions.
  • Contains: canonical.log, control.log, witness.txt
  • Extracted paths: ./poc/poc-F-TEKTON-REGEX-001/canonical.log, ./poc/poc-F-TEKTON-REGEX-001/control.log, ./poc/poc-F-TEKTON-REGEX-001/witness.txt
  • Integrity verification: Compare shasum -a 256 for canonical.log, control.log, fix.patch, and test source against witness.txt.
Note: If a supported integration uses verified HTTPS app-links or universal links only, provide the supported tag or branch and retesting on that pin can be arranged.

Fix

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-25542
GHSA-RMX9-2PP3-XHCR

Affected Products

Github.Com/Tektoncd/Pipeline
Pipeline