Vulnerability Reportkiwigrid/k8s-sidecar:2.14.3

kiwigrid/k8s-sidecar:2.14.3

digestsha256:52d311dcedd587421a236c4d6c621f05614c40a51386e955e0699dca97ec0880

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found 3 vulnerabilities reachable from the network in normal operation, with the highest severity at 4.86, so none of them reach a level that raises the risk rating.• The scan found 5 vulnerabilities that matter only after the container is already compromised, with the highest severity at 3.17.• No known actively exploited vulnerabilities were found, and none of the findings are rated high or critical.• The image runs as a non-root user (65534:65534) with no exposed ports, which limits what an attacker could reach.• The publisher reputation verdict is RELIABLE, and the image is pinned by digest, so its contents are fixed and identifiable.

1/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (1457M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan did find a small number of low-severity issues, 3 reachable from the network in normal operation and 5 that matter only after the container is already compromised, but none are rated high and none are known to be actively exploited. Because the container runs as an unprivileged user and exposes no ports, these findings do not change the overall risk picture. Routine patching during normal image updates is still good practice.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

8 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-97687	MEDIUM4.86	urllib3 2.7.0 fixed in 2.8.0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-97689	MEDIUM4.5	urllib3 2.7.0 fixed in 2.8.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97688	LOW3.18	urllib3 2.7.0 fixed in 2.8.0	0.3% Theoretical Threat	Directly Exposed
CVE-2025-47273	LOW3.17	setuptools 70.3.0 fixed in 78.1.1	1.6% Low-Moderate Risk	Post-Exploit
GHSA-6v7p-g79w-8964	LOW2.7	msgpack 1.1.2 fixed in 1.2.1	—	Post-Exploit
CVE-2026-13346	LOW2.34	pip 26.1.2 fixed in 26.2.0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-59890	LOW2.2	setuptools 70.3.0 fixed in 83.0.0	0.5% Theoretical Threat	Post-Exploit
GHSA-xmj3-9gf7-h52w	LOW0.36	setuptools 70.3.0 fixed in 84.1.0	—	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.