Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan found 31 vulnerabilities reachable from the network in normal operation, but the three most significant ones only apply under specific Istio configurations, such as an active metadata exchange filter or authorization policies that match on Host headers or path fragments. CVE-2022-31045 could crash the proxy and interrupt traffic for the workload, while CVE-2021-39155 could let blocked requests through when hostname-based rules are in use. Avoiding Host-header-based authorization rules would fully eliminate the CVE-2021-39155 risk. Teams should confirm which of these configurations are active in their deployment and update the Istio proxy to a version that contains the fixes.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2022-31045 | HIGH7.84 | istio.io/istio v0.0.0-20261106131748-f6879bae446c fixed in 1.12.18, 1.13.5, 1.14.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-39155 | MEDIUM6 | istio.io/istio v0.0.0-20261106131748-f6879bae446c fixed in 1.9.8, 1.10.4, 1.11.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-39156 | MEDIUM6 | istio.io/istio v0.0.0-20261106131748-f6879bae446c fixed in 1.9.8, 1.10.4, 1.11.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2019-14993 | MEDIUM4.5 | istio.io/istio v0.0.0-20261106131748-f6879bae446c fixed in 1.1.13, 1.2.4 | 2.3% Low-Moderate Risk | Directly Exposed |
| CVE-2022-23635 | MEDIUM4.5 | istio.io/istio v0.0.0-20261106131748-f6879bae446c fixed in 1.13.1, 1.12.4, 1.11.7 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-22185 | MEDIUM4.08 | liblmdb0 0.9.31-1build1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.58.0 No fix yet | — | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-29481 | LOW3.31 | libbpf1 1:1.3.0-2build2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-1352 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-1376 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | — | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.