Tekton Pipelines uses regexp.MatchString to verify trusted resource sources against configured patterns. Because regexp.MatchString returns true if the pattern matches anywhere in the string, unanchored patterns can be bypassed by attacker-controlled source strings that embed the trusted pattern as a substring. This incorrect regular expression usage (CWE-185) can cause unintended policy matches, potentially altering which verification mode or keys are applied to resources. Affected versions are from 0.43.0 up to and including 1.11.0. The vulnerability was published on 2026-04-21 with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No patch or remediation level is currently documented.

The vulnerability allows an attacker with some level of privilege (PR:L) to bypass trusted resource verification policies by crafting source strings that contain the trusted pattern as a substring, causing unintended policy matches. This can lead to the application of incorrect verification modes or keys, potentially enabling integrity verification bypass or unauthorized resource acceptance. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten their regular expression patterns to ensure anchoring and avoid unintentional substring matches. Avoid relying on unanchored patterns for critical verification policies. Monitor official Tekton Pipelines communications for updates on patches or recommended fixes.