Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The most significant issue is CVE-2022-31045 in the pilot-agent binary, which could crash the proxy when it receives malformed headers in certain mesh setups. The authorization-bypass flaws, including CVE-2021-39155, only matter if host-based or path-based authorization policies are in use, and the denial-of-service flaws only apply under specific configurations. The pilot-agent binary is statically linked, so OS library flaws are not reachable through its main process. Reviewing your mesh configuration to confirm whether these conditions apply is the most practical next step.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2022-31045 | HIGH7.84 | istio.io/istio v0.0.0-20261105193526-a079f649cbcb fixed in 1.12.18, 1.13.5, 1.14.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-14993 | MEDIUM6 | istio.io/istio v0.0.0-20261105193526-a079f649cbcb fixed in 1.1.13, 1.2.4 | 2.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-39155 | MEDIUM6 | istio.io/istio v0.0.0-20261105193526-a079f649cbcb fixed in 1.9.8, 1.10.4, 1.11.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-39156 | MEDIUM6 | istio.io/istio v0.0.0-20261105193526-a079f649cbcb fixed in 1.9.8, 1.10.4, 1.11.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2022-23635 | MEDIUM4.5 | istio.io/istio v0.0.0-20261105193526-a079f649cbcb fixed in 1.13.1, 1.12.4, 1.11.7 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-22185 | MEDIUM4.08 | liblmdb0 0.9.31-1build1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.58.0 No fix yet | — | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-29481 | LOW3.31 | libbpf1 1:1.3.0-2build2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-1352 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-1376 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | — | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.