Vulnerability Reportbitnami/sealed-secrets-controller:0.41.2

bitnami/sealed-secrets-controller:latestbitnami/sealed-secrets-controller:0.41.2

digestsha256:e63ec6ec2b12a471bf781081bd370a93ca7b7b3999e5b9243341379aeb801d0b

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found 2 exposed-surface vulnerabilities, with a maximum severity of 4.0, which is low and does not reach the level that would change this verdict.• None of the findings are known to be actively exploited in the wild.• The main process is a statically linked Go program that does not load system shared libraries, so flaws in the OS packages are not reachable through it.• The image runs as a non-root user (1001) and is pinned by digest, which limits the impact of any residual issue.• The publisher's reputation is rated RELIABLE with a high community pull count, which is a supporting factor only and does not drive the verdict.

1/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (3130M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found 2 low-severity issues that are reachable only in limited ways and do not affect the verdict, and no finding is known to be actively exploited. The controller runs as a non-root user and is a statically linked binary, which keeps the practical attack surface small. Routine patching and rescanning on each new build are still good hygiene.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

2 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
DSA-6572-1	MEDIUM4	ca-certificates 20250419 fixed in 20250419+deb13u1	—	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.