Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2026-111497 in brotli-libs, which is actively exploited in the wild, but it would only lead to code execution if a tool inside this container decodes attacker-supplied Brotli data, and the agent itself does not do so. The other findings mostly allow denial of service, such as slowing or crashing the agent through crafted HTTP/2 or TLS traffic, and several of them need a non-default TLS or HTTP/2 setup that dev mode does not enable. Because the container runs as root in dev mode, any future flaw that is exploited would have more room to do damage, so moving off dev mode and running as a non-root user would reduce that risk.
Hardening plan for this image · 4 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | MEDIUM6 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 82.6% Actively Exploited | Directly Exposed |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78667 | MEDIUM6 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.72 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM4.24 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111943 | MEDIUM4.08 | stdlib v1.26.7 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | LOW3.66 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-58055 | LOW3.24 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-86411 | LOW2.12 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-86409 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.