Vulnerability Reportbitnami/mongodb:latest

bitnami/mongodb:latest

digestsha256:81b555bdf58927279f289a4fc1d9b27b14890cdebc1667290ff4c5fd2b79361c

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found 6 exposed-surface vulnerabilities, and the highest severity among them is 4.5, which is low.• None of the exposed findings are known to be actively exploited in the wild.• No vulnerabilities were found that matter only after the container is already compromised.• The image is published by bitnami with a RELIABLE trust verdict and is pinned by digest, which supports consistent deployments.• The container runs as a non-root user (1001) on the exposed MongoDB port 27017.

1/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (1736M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found 6 vulnerabilities reachable in normal operation, but the highest severity is 4.5 and none are known to be actively exploited, so they do not change the verdict. Routine patching through the normal image update cycle is still sensible to keep the attack surface small.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

6 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78659	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed
CVE-2026-97032	LOW3.54	golang.org/x/net v0.59.0 fixed in 0.60.0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	golang.org/x/net v0.59.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.