Vulnerability Reportcloudflare/cloudflared:2026.10.1

cloudflare/cloudflared:latestcloudflare/cloudflared:1972-8e090e5bfa7acloudflare/cloudflared:1972-8e090e5cloudflare/cloudflared:2026.10.1

digestsha256:a15a3b50b8dabd57ac2090e9484c0247dba9dfa1f0df4d298d4317f9d69eb2d5

Executive Summary

Last scanned: Oct 19, 2026

Threat ScoreSAFE• Pre-calculated threat score is 0, which falls in the SAFE band (0–24).• Trust signals are strong: publisher cloudflare, POPULAR COMMUNITY, RELIABLE verdict, score 90, 240M+ pulls, and digest pinning.• Vulnerability stats show exposed_total 17, but exposed_count_ge6 is 0 and exposed_count_ge7 is 0; exposed_max_severity is 5.95.• Post-exploit stats show post_total 20, but post_count_ge6 is 0; post_max_severity is 3.53.• No exposed_surface or post_exploit_only findings were supplied, so no CVE IDs from INPUT 4 or INPUT 5 are available to cite.• Startup command is limited to version reporting and environment keys are minimal, with no high-severity findings driving risk.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (240M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The stats do show 17 exposed and 20 post-exploit findings, but none reach 6.0 or higher severity, with exposed max severity 5.95 and post-exploit max severity 3.53. No CVE IDs were present in the supplied findings lists, so none are cited. Strong trust signals—Cloudflare as publisher, 240M+ pulls, and digest pinning—support this verdict. Standard image hygiene and periodic updates remain appropriate.

Vulnerabilities

Vulnerability Log

37 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-86805	MEDIUM5.95	libc6 2.41-12+deb13u4 No fix yet	<0.1% Theoretical Threat	Directly Exposed
CVE-2026-95818	MEDIUM5.95	libc6 2.41-12+deb13u4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-19499	MEDIUM5.78	libc6 2.41-12+deb13u4 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-6368	MEDIUM4.67	libc6 2.41-12+deb13u4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-27171	MEDIUM4.67	zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-8674	MEDIUM4.5	libc6 2.41-12+deb13u4 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-84784	MEDIUM4.5	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.17	libc6 2.41-12+deb13u4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-54875	MEDIUM4	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2010-4756	MEDIUM4	libc6 2.41-12+deb13u4 No fix yet	2.6% Low-Moderate Risk	Directly Exposed
CVE-2026-19542	LOW3.57	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89092	LOW3.57	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2019-1010022	LOW3.53	libc6 2.41-12+deb13u4 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010023	LOW3.17	libc6 2.41-12+deb13u4 No fix yet	3.1% Low-Moderate Risk	Post-Exploit
CVE-2026-97399	LOW3.15	libc6 2.41-12+deb13u4 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35189	LOW3.15	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35191	LOW3.15	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2018-20796	LOW2.7	libc6 2.41-12+deb13u4 No fix yet	5.8% Low-Moderate Risk	Post-Exploit
CVE-2019-9192	LOW2.7	libc6 2.41-12+deb13u4 No fix yet	2.4% Low-Moderate Risk	Post-Exploit
CVE-2026-84782	LOW2.26	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Post-Exploit
CVE-2026-6238	LOW1.99	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2019-1010024	LOW1.91	libc6 2.41-12+deb13u4 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010025	LOW1.91	libc6 2.41-12+deb13u4 No fix yet	2.5% Low-Moderate Risk	Post-Exploit
CVE-2026-5435	LOW1.81	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-6791	LOW1.81	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-77117	LOW1.81	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-80489	LOW1.81	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-54872	LOW1.81	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Post-Exploit
CVE-2026-72897	LOW1.81	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Post-Exploit
CVE-2026-75805	LOW1.81	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.2% Theoretical Threat	Post-Exploit
CVE-2026-77696	LOW1.81	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.2% Theoretical Threat	Post-Exploit
CVE-2026-42772	LOW1.62	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Post-Exploit
CVE-2026-54873	LOW1.62	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Post-Exploit
CVE-2026-75804	LOW1.62	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Post-Exploit
CVE-2026-75806	LOW1.62	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Post-Exploit
CVE-2026-85091	NONE0	zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet	0.4% Theoretical Threat	Not Applicable
GO-2026-5932	NONE0	golang.org/x/crypto v0.58.0 No fix yet	—	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.