Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2023-54404 in the zod validation library, which could let a crafted request with very large arrays exhaust memory and crash Kibana, causing a service outage rather than data theft or code execution. The scan notes that the flaw depends on how Kibana's request schemas use unbounded arrays, and it does not require a non-default configuration. Updating the zod packages is the practical step to reduce this exposure.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2023-54404 | MEDIUM6 | zod 3.25.76 fixed in 4.6.6 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2023-54404 | MEDIUM6 | zod 4.1.12 fixed in 4.6.6 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.6.1-2ubuntu0.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-8769 | MEDIUM5.2 | @ai-sdk/provider-utils 3.0.25 fixed in 3.0.28, 4.0.33, 5.0.1 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-85x2-q946-cp5h | MEDIUM5.2 | nodemailer 10.0.16 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM5.2 | nodemailer 10.0.16 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-m943-m63m-w62w | MEDIUM5.2 | nodemailer 10.0.16 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-102990 | MEDIUM4.5 | basic-ftp 5.3.1 fixed in 6.2.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-cassandra-driver 0.65.0 fixed in 0.66.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-knex 0.64.0 fixed in 0.65.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-mongoose 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-mysql 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-mysql2 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-oracledb 0.45.0 fixed in 0.46.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-pg 0.72.0 fixed in 0.73.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | LOW3.48 | @opentelemetry/instrumentation-tedious 0.39.0 fixed in 0.40.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-2739 | LOW3.18 | bn.js 4.11.9 fixed in 4.12.3, 5.2.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | — | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2024-53382 | LOW2.75 | prismjs 1.27.0 fixed in 1.30.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-45819 | NONE0 | baseline-browser-mapping 2.9.14 fixed in 2.11.0 | 0.5% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.