Vulnerability Reportbuildkite/agent:3.128-sidecar

buildkite/agent:3.128-sidecar

digestsha256:1045457693ee8ff2435ae1565dfb005aba7e866c536ae3b9d41527666f0d1e3c

Executive Summary

Last scanned: Jul 28, 2026

Threat ScoreSAFE• Low vulnerability severity: max exposed severity 3.6 and max post-exploit severity 2.7• High community trust: popular image with 9M+ pulls, pinned by digest• No critical or high severity findings in exposed surface or post-exploit analysis• Reliable publisher (buildkite) with a reputation score of 90

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (9M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The image contains a few low-severity vulnerabilities (exposed max 3.6, post-exploit max 2.7), but none pose a significant practical risk due to their low impact and the image's strong trust credentials. No mitigations or configuration changes are necessary.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

6 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-42505	LOW3.6	stdlib v1.25.11 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-50274	LOW2.7	github.com/DataDog/dd-trace-go/v2 v2.7.1 fixed in 2.8.1	—	Post-Exploit
CVE-2026-39822	LOW2.39	stdlib v1.25.11 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.2% Theoretical Threat	Post-Exploit
GO-2026-5932	NONE0	golang.org/x/crypto v0.53.0 No fix yet	—	Not Applicable
CVE-2026-56852	NONE0	golang.org/x/text v0.38.0 fixed in 0.39.0	—	Not Applicable
GHSA-hrxh-6v49-42gf	NONE0	google.golang.org/grpc v1.81.1 fixed in 1.82.1	—	Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.