CVE-2026-25542

2 advisories.

Go/github.com/tektoncd/pipeline CVE-2026-25542: medium 6.5, EPSS 0.39%

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching

Action: Upgrade github.com/tektoncd/pipeline to 1.0.2 or later.

go get github.com/tektoncd/pipeline@v1.0.2

go get github.com/tektoncd/pipeline@v1.3.4

go get github.com/tektoncd/pipeline@v1.6.2

go get github.com/tektoncd/pipeline@v1.9.3

go get github.com/tektoncd/pipeline@v1.11.1

1.0.2

1.3.4

1.6.2

1.9.3

1.11.1

CVE-2026-25542 · published 2026-04-21T16:25:19Z · modified 2026-09-10T03:51:03.127944585Z · JSON

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline