Vulnerability Reportbuildkite/agent:3-sidecar

buildkite/agent:3.129.0-sidecarbuildkite/agent:3.129-sidecarbuildkite/agent:3-sidecarbuildkite/agent:oldstable-sidecarbuildkite/agent:sidecar

digestsha256:0851d265518d8af0984104322a8b2756488cf1370b0e45d05fc401b878ece8f0

Executive Summary

Last scanned: Aug 3, 2026

Threat ScoreSAFE• High-reputation community image with 9.6M+ pulls and RELIABLE publisher verdict.• Pinned by digest (immutable) ensuring supply chain integrity.• Threat score is 0, well within the SAFE band.• No exposed-surface or post-exploit findings were provided.• Maximum exposed severity is 5.3 (low); maximum post-exploit severity is 2.29 (negligible).

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (9M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. Although the vulnerability scan reports 5 exposed vulnerabilities and 1 post-exploit vulnerability, the maximum severity is low (5.3) and no specific CVEs were surfaced as notable findings. The image is a popular community buildkite agent, pinned by digest, and carries a reliable trust verdict. The low severity and absence of high-impact findings mean the risk to production workloads is minimal.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

6 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-39822	MEDIUM5.3	stdlib v1.25.11 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-42505	LOW2.7	stdlib v1.25.11 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-50274	LOW2.29	github.com/DataDog/dd-trace-go/v2 v2.7.1 fixed in 2.8.1	0.4% Theoretical Threat	Post-Exploit
GO-2026-5932	NONE0	golang.org/x/crypto v0.53.0 No fix yet	—	Not Applicable
CVE-2026-56852	NONE0	golang.org/x/text v0.38.0 fixed in 0.39.0	0.4% Theoretical Threat	Not Applicable
GHSA-hrxh-6v49-42gf	NONE0	google.golang.org/grpc v1.81.1 fixed in 1.82.1	—	Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.