Vulnerability Reporthenrygd/beszel:0.21.1

henrygd/beszel:latesthenrygd/beszel:edgehenrygd/beszel:0henrygd/beszel:0.21henrygd/beszel:0.21.1

digestsha256:8514a69d9bbbcb74f371a3205561ee231fc0289739cea64e8131f341d695b770

Executive Summary

Last scanned: Nov 11, 2026

Threat ScoreSAFE• The scan found 2 exposed findings, with a highest severity of 4.67, and none are known to be actively exploited.• Neither exposed finding has severity of 6.0 or higher, so neither affects the verdict.• No post-exploitation-only findings were reported.• The main program is a statically linked Go binary that does not load system shared libraries, which limits how far OS-level flaws can reach it.• The publisher reputation is RELIABLE, with the image pinned by digest.• The container runs as root by default and listens on port 8090, so tightening its user and network access remains good practice.

1/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (27M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found two low-severity issues that can be reached over the network, but the highest severity is 4.67 and neither is known to be exploited in the wild, so they do not change the verdict. Because the main program is a self-contained Go binary, flaws in the underlying OS libraries are not reachable through it. Routine hardening, such as running the service as a non-root user and restricting access to port 8090, is still worthwhile.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

2 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2023-36308	MEDIUM4.67	github.com/disintegration/imaging v1.6.2 No fix yet	0.4% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.