CVE-2026-25542: Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching

The Trusted Resources verification system matches a resource source string (refSource.URI) against spec.resources[].pattern using Go’s regexp.MatchString. In Go, regexp.MatchString reports a match if the pattern matches anywhere in the input string. As a result, common unanchored patterns—including examples found in Tekton documentation—can be bypassed by attacker-controlled source strings that contain the trusted pattern as a substring. This may cause an unintended policy match and alter which verification mode or keys are applied.