Vulnerability Reportcloudflare/cloudflared:2026.6.1

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. Scanning shows 41 exposed findings with 4 at severity 6.0 or above (maximum 6.38), plus 17 post-exploit findings that all sit at severity 3.53 or below. The notable items are denial-of-service issues in bundled libraries, such as CVE-2026-84445 (a malformed gRPC request can panic an xDS-based gRPC server process) and CVE-2026-56862 (indefinite TLS KeyUpdate messages forcing repeated key derivation). In practical terms the worst outcome is service disruption or memory exhaustion rather than code execution or data exposure. Note that CVE-2026-84445 only applies to servers created through the xDS gRPC server constructor, so a standard tunnel deployment should not be affected. Upgrading the bundled OpenSSL and Go components when a patched image is published would remove these paths entirely.