Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The 43 exposed findings and 9 post-exploit findings are acknowledged, but the top items are medium-impact and largely conditional on specific configuration. CVE-2026-17106 matters mainly if the daemon pulls or extracts untrusted images, and CVE-2026-78669 affects availability only when TLS on port 2376 is enabled. Because the container runs as root and exposes ports 2375 and 2376, limiting network access to the Docker API and enforcing strict TLS client verification are sensible hardening steps.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-17106 | MEDIUM6.24 | github.com/moby/go-archive v0.2.0 fixed in 0.3.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41567 | MEDIUM5.76 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111497 | MEDIUM5.59 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-10722 | MEDIUM5.5 | github.com/cilium/ebpf v0.17.3 fixed in 0.22.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-61801 | MEDIUM5.5 | github.com/moby/sys/user v0.4.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-85747 | MEDIUM5.44 | github.com/docker/distribution v2.8.3+incompatible No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33997 | MEDIUM4.86 | github.com/docker/docker v28.5.2+incompatible fixed in 29.3.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-46600 | MEDIUM4.5 | golang.org/x/net v0.55.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42306 | MEDIUM4.32 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.58.0 No fix yet | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.56.0 No fix yet | — | Directly Exposed |
| CVE-2026-41568 | LOW3.6 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.