Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who controls a malicious server that the helper contacts could exploit CVE-2026-111497 to corrupt helper memory and possibly execute code within the CI job environment. CVE-2026-111497 carries no special configuration requirement according to its analysis, so it is relevant in normal operation whenever the helper fetches from untrusted endpoints. The 18 post-exploit-only findings have a maximum severity of 2.92 and do not drive this verdict. Because the container runs as root by default, restricting the destinations the runner can reach and applying least-privilege controls would limit the consequences of any compromise.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | HIGH7.45 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 36.0% High Exploitation Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-97032 | LOW3.54 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | LOW3.18 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86411 | LOW2.12 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86409 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.