Vulnerability Reportbitnami/kubectl:latest

bitnami/kubectl:latest

digestsha256:8f59408f9e896fc8992a0660a56687545bd06751f26531b4a26fca6d5dc7562d

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found 11 lower-risk findings in the image, but none reached high severity; the highest severity recorded is 4.5.• No findings are known to be actively exploited in the wild.• No findings are reachable only after the container is already compromised.• The main process is a statically linked Go program that does not load system shared libraries, so flaws in OS libraries are not reachable through it.• The container runs as non-root user 1001 and exposes no ports, which limits what a remote attacker can reach.• The publisher reputation is RELIABLE, with the image pinned by digest.

2/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (5389M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found 11 findings, but none are rated high severity, the highest is 4.5, and none are known to be exploited in the wild. The kubectl binary is statically linked and runs as non-root user 1001 with no exposed ports, so these lower-risk findings do not materially change the risk in this context. The findings should still be tracked during routine image updates.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

11 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78659	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78669	MEDIUM4.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78659	MEDIUM4.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-56851	MEDIUM4.5	golang.org/x/text v0.40.0 fixed in 0.41.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-97032	LOW3.54	golang.org/x/net v0.59.0 fixed in 0.60.0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-97032	LOW3.54	golang.org/x/net v0.57.0 fixed in 0.60.0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	golang.org/x/net v0.59.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	golang.org/x/net v0.57.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.