products / tekton
Tekton Pipelines
Tekton provides Kubernetes CRDs for CI/CD steps, tasks, and pipelines. NVD lists the core controller as linuxfoundation:tekton_pipelines. CVE volume is lower than Jenkins or GitLab; Attestd tracks Tekton after confirming sufficient non-sentinel NVD version ranges.
api usage
Querying Tekton
product slug
tektonversion format
0.60.0, 1.9.2bash
curl "https://api.attestd.io/v1/check?product=tekton&version=0.60.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Example for a release in NVD ranges for pipeline controller issues. Re-verify risk_state on your cluster image tag (Tekton Pipelines version, not Tekton Operator version).
json
{
"product": "tekton",
"version": "0.60.0",
"supported": true,
"risk_state": "elevated",
"risk_factors": [
"remote_code_execution",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": true,
"patch_available": true,
"fixed_version": "1.11.1",
"confidence": 0.5,
"cve_ids": [
"CVE-2026-25542",
"CVE-2026-33022",
"CVE-2026-40923",
"CVE-2026-40924"
],
"cves": null,
"max_epss": 0.00368,
"last_updated": "2026-07-09T00:32:33.027992Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}newer line
1.10.0 is a representative newer pipeline release for a post-patch spot check.
bash
curl "https://api.attestd.io/v1/check?product=tekton&version=1.11.1" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2023-37264 | Pipeline policy enforcement gap in controller. | see NVD / controller | 3.7 |
CVE-2026-33022 | Controller: privilege boundary fixes across release lines. | see NVD / controller lines | 6.5 |
CVE-2026-33211 | Additional pipeline controller hardening (NVD ranges). | see NVD / controller | N/A |
related