Vulnerability Reportgrafana/loki:3.6.19

grafana/loki:3.6.19

digestsha256:0f9cbc340cbe33ee498e654075034336962057db072f57b37f253e14d476443a

Executive Summary

Last scanned: Oct 26, 2026

Threat ScoreSAFE• Threat score is 0, which places the image in the SAFE band.• Trust status is VERIFIED and TRUSTED from publisher grafana, with digest pinning noted.• Vulnerability stats show exposed_total 2, exposed_count_ge6 0, exposed_count_ge7 0, and exposed_max_severity 3.6.• No post-exploit-only findings are present (post_total 0, post_max_severity 0.0).• No CVE IDs appear in the provided exposed-surface or post-exploit findings, so no specific CVE is cited.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. It is a verified Grafana Loki image pinned by digest, and the pre-calculated threat score is 0. Two exposed-surface issues are recorded, but the maximum exposed severity is 3.6 and none reach the higher-severity thresholds. There are no post-exploit-only findings, and no CVE IDs are present in the provided findings to cite.

Relevant for grafana/loki:3.6.19

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

3 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-21726	LOW3.6	github.com/grafana/loki/v3 v3.0.0-20261020212142-de41836f1cfe fixed in 3.6.4	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
DSA-6572-1	NONE0	ca-certificates 20250419 fixed in 20250419+deb13u1	—	Not Applicable
GO-2026-5932	NONE0	golang.org/x/crypto v0.57.0 No fix yet	—	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.