Vulnerability Reportdocker:29.9.3

docker:latestdocker:29docker:dinddocker:29.9.3-dind-alpine3.24docker:29.9.3-dinddocker:29.9.3-alpine3.24docker:29.9.3docker:29.9-dinddocker:29.9docker:29-dind

digestsha256:d035bd30886e451b2727ef3cdb9af9a5c537a10d4bc5d18c08d0ffa597e46aeb

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreSAFE• The scan found 13 exposed-surface findings, but the highest severity among them is 5.76 and none are listed as actively exploited.• No exposed-surface finding is rated 6.0 or above, so nothing reachable in normal operation reaches a serious severity level.• The 13 post-exploit findings only matter after the container is already compromised, and the highest of them is rated 2.7.• The image comes from the Docker Official publisher, is pinned by digest, and carries a TRUSTED reputation verdict.• The threat score is low, and no finding meets the threshold that would raise the verdict.• The container runs as root by default and exposes the Docker daemon ports 2375 and 2376, so the deployment should still follow standard hardening practice such as enabling TLS and restricting network access.

4/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan found 13 vulnerabilities reachable in normal operation, but none are rated high and none are known to be actively exploited, so they do not drive the verdict. The 13 post-exploit findings only matter if an attacker has already compromised the container, and the highest of them is low severity. Because the container runs as root and exposes Docker daemon ports, keep those ports restricted to trusted networks and use TLS as a routine hardening step.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

26 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-41567	MEDIUM5.76	github.com/docker/docker v28.5.2+incompatible No fix yet	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-42306	MEDIUM5.76	github.com/docker/docker v28.5.2+incompatible No fix yet	0.1% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-10722	MEDIUM5.5	github.com/cilium/ebpf v0.17.3 fixed in 0.22.0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-61801	MEDIUM5.5	github.com/moby/sys/user v0.4.0 fixed in 0.4.1	0.1% Theoretical Threat	Directly Exposed
CVE-2026-85747	MEDIUM5.44	github.com/docker/distribution v2.8.3+incompatible No fix yet	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-33997	MEDIUM4.86	github.com/docker/docker v28.5.2+incompatible fixed in 29.3.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-17106	MEDIUM4.68	github.com/moby/go-archive v0.2.0 fixed in 0.3.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.55.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed
CVE-2026-41568	LOW3.6	github.com/docker/docker v28.5.2+incompatible No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-78669	LOW2.7	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78659	LOW2.7	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-46600	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.56.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-78669	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78659	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78669	LOW2.7	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78659	LOW2.7	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-97032	LOW2.12	golang.org/x/net v0.58.0 fixed in 0.60.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-97032	LOW2.12	golang.org/x/net v0.55.0 fixed in 0.60.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-97032	LOW2.12	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-78663	LOW1.91	golang.org/x/net v0.58.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78663	LOW1.91	golang.org/x/net v0.55.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78663	LOW1.91	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.