Vulnerability Reportamazon/cloudwatch-agent:latest

amazon/cloudwatch-agent:latestamazon/cloudwatch-agent:1.300074.1b2005

digestsha256:2c67a6ad07c503a64d3c45244a737c56c420832aabaefee2adbf1682f38f6510

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-78669 in golang.org/x/net (severity 6.0) lets a malicious HTTP/2 peer drive excessive CPU use and slow or hang the agent. The flaw applies to outbound connections as well as inbound listeners.• CVE-2026-78659 in golang.org/x/net can exhaust memory through large HTTP/2 trailer headers, but only if an inbound HTTP/2 server listener is enabled. The image exposes no ports by default.• CVE-2026-84304 in google.golang.org/grpc can exhaust memory and crash the agent, but only if a gRPC server listener is enabled. The agent's gRPC use is mainly outbound.• The scan found 24 exposed findings in total. Three are rated 6.0 or above, and none is rated 7.0 or higher or is known to be actively exploited.• No post-compromise-only findings were reported, and the trust check rates the publisher TRUSTED.

29/100NEEDS ATTENTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan found 24 exposed findings, and the three rated 6.0 or above are denial-of-service flaws in the bundled golang.org/x/net and google.golang.org/grpc libraries. The most relevant is CVE-2026-78669, which could let a malicious HTTP/2 peer slow or hang the agent. CVE-2026-84304 matters only if a gRPC server listener is enabled, and CVE-2026-78659 only if an inbound HTTP/2 listener is enabled, so neither affects the default setup. These issues cause availability problems rather than data theft or code execution, so they do not change the overall rating.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

24 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM6	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-84304	MEDIUM6	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-81871	MEDIUM5.2	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 fixed in 0.21.0	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM4.72	golang.org/x/net v0.57.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-43871	MEDIUM4.5	github.com/apache/thrift v0.23.0 fixed in 0.24.0	1.0% Low-Moderate Risk	Directly Exposed
CVE-2026-42151	MEDIUM4.5	github.com/prometheus/prometheus v0.311.2-0.20260409145810-72293ff1d2e0 fixed in 0.311.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-42154	MEDIUM4.5	github.com/prometheus/prometheus v0.311.2-0.20260409145810-72293ff1d2e0 fixed in 0.311.3, 0.305.2	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56851	MEDIUM4.5	golang.org/x/text v0.40.0 fixed in 0.41.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-84445	MEDIUM4.5	google.golang.org/grpc v1.82.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56854	MEDIUM4.08	golang.org/x/crypto v0.54.0 fixed in 0.55.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-84303	LOW3.78	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.3% Theoretical Threat	Directly Exposed
CVE-2026-40179	LOW3.66	github.com/prometheus/prometheus v0.311.2-0.20260409145810-72293ff1d2e0 fixed in 3.5.2, 3.11.2, 0.311.2-0.20260410083055-07c6232d159b	0.3% Theoretical Threat	Directly Exposed
CVE-2026-44903	LOW3.66	github.com/prometheus/prometheus v0.311.2-0.20260409145810-72293ff1d2e0 fixed in 0.311.3	0.2% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/sdk v1.44.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81872	LOW3.18	go.opentelemetry.io/otel/sdk/log v0.19.0 fixed in 0.21.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56855	LOW3.18	golang.org/x/crypto v0.54.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	LOW3.18	golang.org/x/crypto v0.54.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
GO-2026-5932	LOW2.4	golang.org/x/crypto v0.54.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.