Tekton Pipelines uses Go's regexp.MatchString function to verify trusted resources by matching a resource source string against configured patterns. Because regexp.MatchString returns true if the pattern matches anywhere in the string, unanchored patterns can be bypassed by crafted source strings containing the pattern as a substring. This leads to unintended policy matches that may change the verification mode or keys applied to resources. The vulnerability affects multiple version ranges before fixed releases 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, which address this issue.

An attacker controlling resource source strings can bypass trusted resource verification policies by exploiting the unanchored regular expression matching. This can cause the system to apply incorrect verification modes or keys, potentially allowing unauthorized or malicious resources to be treated as trusted. The CVSS score of 6.5 reflects a medium severity with no confidentiality or availability impact but a high integrity impact. No known exploits in the wild have been reported.

Fixed versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 of Tekton Pipelines address this vulnerability. Users should upgrade to one of these versions or later to remediate the issue. Patch status is not explicitly stated beyond these fixed versions; therefore, verify with the vendor advisory for the latest remediation guidance. No alternative mitigations are indicated in the advisory.