Vulnerability Reportamazon/amazon-ecs-agent:latest

amazon/amazon-ecs-agent:latestamazon/amazon-ecs-agent:592b3015amazon/amazon-ecs-agent:v1.108.2

digestsha256:6362235a5ac662d4c7de6625e1dd43681277dafa21fc0b6a2be9dae48327c19b

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found two vulnerabilities reachable in normal operation, but the highest severity among them is 4.0, which is low and does not affect this verdict.• None of the findings are known to be actively exploited in the wild.• No vulnerabilities were found that matter only after the container is already compromised.• The main program is a statically linked Go binary that does not load system shared libraries, so flaws in OS libraries are not reachable through it.• The image is published by a verified publisher (trust verdict TRUSTED) and is pinned by digest, which supports its integrity.

1/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan did report two low-severity issues, with a maximum severity of 4.0, and neither is known to be actively exploited. Because the main program is a statically linked binary that does not load system libraries, most operating-system-level flaws cannot reach it. Routine patching of the base image is still good hygiene, but these findings do not change the production decision.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

2 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-39824	MEDIUM4	golang.org/x/sys v0.17.0 fixed in 0.44.0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-39824	MEDIUM4	golang.org/x/sys v0.24.0 fixed in 0.44.0	0.1% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.