Tekton Pipelines uses regular expression matching in its VerificationPolicy to validate resource source strings against defined patterns. The Go function used, regexp.MatchString, reports a match when the pattern appears anywhere in the target string. Consequently, unanchored patterns can be circumvented when an attacker controls a source string that contains the trusted pattern as a substring, allowing the policy to falsely approve the resource. This flaw can result in a pipeline configuration being verified under an incorrect set of keys or modes, potentially enabling the execution of malicious or unauthorized code within the CI/CD workflow.

The vulnerability affects Tekton Pipelines versions 0.43.0 through 1.11.0 released by the TektonCD project. Any cluster running a version in this range and relying on VerificationPolicies for resource validation is impacted.

The CVSS score of 6.5 indicates a medium severity risk. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can supply or influence pipeline resource definitions, inserting a source string that contains the trusted pattern as a substring. By doing so, the attacker can cause an unintended policy match and alter the verification mode or keys applied to the pipeline. The exploitation requires the ability to modify or author a resource within the cluster, which may be achievable through privileged user or compromised CI tooling.