Vulnerability Reportcalico/cni:v3.32.3

calico/cni:v3.32.3

digestsha256:61162b8086688a2024f7cad283334e14d006f8b6e94ba622cfe9f00b7e75fdd3

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found 6 vulnerabilities that could be reached in normal operation, with the highest severity at 4.5, so none are serious in this context.• None of the findings are known to be actively exploited in the wild.• The main process is a statically linked Go program that does not load system shared libraries, so flaws in OS libraries are not reachable through it.• No additional vulnerabilities were identified that matter only after the container is already compromised.• The image runs as root by default, which is worth tightening in hardened deployments even though it does not change the verdict.• Publisher reputation is RELIABLE and the image is pinned by digest, which supports its integrity.

1/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (1334M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan did find 6 vulnerabilities, but the highest severity is 4.5 and none are known to be actively exploited, so they do not change the verdict. The main program is a statically linked Go binary that does not load system libraries, which limits how far OS-level flaws could be reached. Running as root by default is still worth restricting in hardened environments to reduce the impact of any future issue.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

6 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78659	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed
CVE-2026-97032	LOW3.54	golang.org/x/net v0.58.0 fixed in 0.60.0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	golang.org/x/net v0.58.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.