Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The two notable findings both sit in the urllib3 HTTP library, and CVE-2026-97687 only matters if an HTTPS proxy is set up with certificate checks disabled, which is a non-default configuration. CVE-2026-97689 could allow a memory-exhaustion denial of service if the agent contacts a malicious server, so upgrading urllib3 to a fixed release is the practical step. The remaining findings are lower severity and do not change the overall assessment.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-97687 | MEDIUM6.48 | urllib3 2.7.0 fixed in 2.8.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97689 | MEDIUM6 | urllib3 2.7.0 fixed in 2.8.0 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-88647 | MEDIUM5.52 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-61801 | MEDIUM5.5 | github.com/moby/sys/user v0.4.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-47273 | MEDIUM5.28 | setuptools 70.3.0 fixed in 78.1.1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-102275 | MEDIUM4.92 | PyJWT 2.14.0 fixed in 2.15.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-33997 | MEDIUM4.86 | github.com/docker/docker v28.5.3-0.20260325154711-31a1689cb0a1+incompatible fixed in 29.3.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101918 | MEDIUM4.5 | PyJWT 2.14.0 fixed in 2.15.0 | 0.4% Theoretical Threat | Directly Exposed |
| GHSA-6v7p-g79w-8964 | MEDIUM4.5 | msgpack 1.1.2 fixed in 1.2.1 | — | Directly Exposed |
| CVE-2026-95184 | MEDIUM4.24 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97688 | MEDIUM4.24 | urllib3 2.7.0 fixed in 2.8.0 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-49265 | MEDIUM4.08 | oauthlib 3.3.1 fixed in 4.0.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | MEDIUM4 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-95210 | MEDIUM4 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-qp9x-wp8f-qgjj | MEDIUM4 | tuf 4.0.0 fixed in 7.0.0 | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-49264 | LOW3.66 | oauthlib 3.3.1 fixed in 4.0.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-59890 | LOW3.66 | setuptools 70.3.0 fixed in 83.0.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-29481 | LOW3.31 | libbpf1 1:1.3.0-2build2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-1352 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-1376 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| GHSA-2mjx-qc3c-rqvc | LOW3.18 | rustls 0.23.43 fixed in 0.23.45 | — | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| GHSA-xmj3-9gf7-h52w | LOW0.6 | setuptools 70.3.0 fixed in 84.1.0 | — | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.