Last scanned:
··This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who reaches the gRPC receivers or the query UI could exhaust CPU or memory, stopping trace ingestion or the query service. The gRPC receivers accept unauthenticated HTTP/2 traffic in the default configuration, so anyone who can reach those ports can trigger these outages, and enabling authentication closes that anonymous path. Most flagged issues are denial-of-service rather than code execution or data theft, but the 5 findings at severity 7.0 or higher on reachable paths justify strict network restrictions. Note that CVE-2026-43871 applies only if the Thrift receivers are enabled.
Hardening plan for this image · 5 steps. The first cuts risk from 66 to 0.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| GHSA-hrxh-6v49-42gf | HIGH8.8 | google.golang.org/grpc v1.81.1 fixed in 1.82.1 | — | Directly ExposedContext importance: HIGH |
| CVE-2026-84304 | HIGH7.5 | google.golang.org/grpc v1.81.1 fixed in 1.83.1 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78667 | HIGH7.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78669 | HIGH7.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78659 | HIGH7.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56858 | MEDIUM6.48 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97030 | MEDIUM6.1 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-43871 | MEDIUM6 | github.com/apache/thrift v0.23.1-0.20260429145742-d2acd3c49e58 fixed in 0.24.0 | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27145 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33818 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56853 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56862 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42764 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42764 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.26.3 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42766 | MEDIUM5.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.26.3 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42507 | MEDIUM5.3 | stdlib v1.26.3 fixed in 1.25.11, 1.26.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84445 | MEDIUM4.5 | google.golang.org/grpc v1.81.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56860 | MEDIUM4.5 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-81872 | MEDIUM4.24 | go.opentelemetry.io/otel/sdk/log v0.19.0 fixed in 0.21.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-81871 | LOW3.9 | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 fixed in 0.21.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-84303 | LOW3.78 | google.golang.org/grpc v1.81.1 fixed in 1.83.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/sdk v1.44.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | LOW3.28 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-45445 | LOW3.28 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-39821 | LOW2.95 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Post-Exploit |
| CVE-2026-45447 | LOW2.92 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-45447 | LOW2.92 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-39822 | LOW2.81 | stdlib v1.26.3 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-14456 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-18798 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Post-Exploit |
| CVE-2026-34183 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-63072 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-63076 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-14457 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-54874 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63074 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63075 | LOW2.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-14456 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-18798 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Post-Exploit |
| CVE-2026-34183 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-63072 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-63076 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-14457 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-54874 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63074 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63075 | LOW2.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63209 | LOW2.7 | github.com/klauspost/compress v1.18.6 fixed in 1.18.7 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-46600 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78669 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-78659 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-78660 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-56851 | LOW2.7 | golang.org/x/text v0.37.0 fixed in 0.41.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-56852 | LOW2.7 | golang.org/x/text v0.37.0 fixed in 0.39.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-42504 | LOW2.7 | stdlib v1.26.3 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-46600 | LOW2.7 | stdlib v1.26.3 fixed in 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-56859 | LOW2.7 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-56854 | LOW2.45 | golang.org/x/crypto v0.52.0 fixed in 0.55.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-97032 | LOW2.12 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-56855 | LOW1.91 | golang.org/x/crypto v0.52.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78662 | LOW1.91 | golang.org/x/crypto v0.52.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-78663 | LOW1.91 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | LOW1.44 | golang.org/x/crypto v0.52.0 No fix yet | — | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.