Vulnerability Reportlonghornio/longhorn-manager:v1.10.1

longhornio/longhorn-manager:v1.10.1
DIGESTsha256:afda26c16e7ab106f94dbc11da1bc91f410487d2e66609ebd126f0d908f7243a

Executive Summary

Threat Score
50/100CAUTION
Reputation
RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could cause denial of service through multiple vectors, including TLS key update deadlocks (CVE-2026-32283), HTTP/2 infinite loops (CVE-2026-33814), and OpenTelemetry baggage flooding (CVE-2026-29181), or potentially bypass TLS authentication (CVE-2025-68121) or gRPC authorization (CVE-2026-33186) under specific configurations. Note that some vulnerabilities require non-default configurations: CVE-2025-68121 only applies if TLS Config is mutated between handshakes, and CVE-2026-33186 only affects gRPC servers with path-based authorization interceptors using canonical deny rules with a fallback allow. Upgrading the Go runtime and gRPC library would address the majority of these issues.

Vulnerabilities

Vulnerability Log

130 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2025-68121MEDIUM6.8
stdlib
v1.25.3
fixed in 1.24.13, 1.25.7, 1.26.0-rc.3
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-29181MEDIUM6.38
go.opentelemetry.io/otel
v1.37.0
fixed in 1.41.0
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2025-61726MEDIUM6.38
stdlib
v1.25.3
fixed in 1.24.12, 1.25.6
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2025-61729MEDIUM6.38
stdlib
v1.25.3
fixed in 1.24.11, 1.25.5
0.5%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-25679MEDIUM6.38
stdlib
v1.25.3
fixed in 1.25.8, 1.26.1
0.5%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32280MEDIUM6.38
stdlib
v1.25.3
fixed in 1.25.9, 1.26.2
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32281MEDIUM6.38
stdlib
v1.25.3
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32283MEDIUM6.38
stdlib
v1.25.3
fixed in 1.25.9, 1.26.2
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-33814MEDIUM6.38
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-33186MEDIUM6.18
google.golang.org/grpc
v1.76.0
fixed in 1.79.3
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2025-61727MEDIUM5.52
stdlib
v1.25.3
fixed in 1.24.11, 1.25.5
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32282MEDIUM5.44
stdlib
v1.25.3
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-33811MEDIUM5.1
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2025-61728MEDIUM5.1
stdlib
v1.25.3
fixed in 1.24.12, 1.25.6
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32288MEDIUM4.67
stdlib
v1.25.3
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2025-58181MEDIUM4.5
golang.org/x/crypto
v0.42.0
fixed in 0.45.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2025-61730MEDIUM4.5
stdlib
v1.25.3
fixed in 1.24.12, 1.25.6
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39820LOW2.29
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-39836LOW2.29
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-27139LOW2.12
stdlib
v1.25.3
fixed in 1.25.8, 1.26.1
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-32289LOW1.87
stdlib
v1.25.3
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-13281LOW1.78
k8s.io/kubernetes
v1.34.1
fixed in 1.32.10, 1.33.6, 1.34.2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-27142LOW1.65
stdlib
v1.25.3
fixed in 1.25.8, 1.26.1
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-39826LOW1.65
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2025-47914LOW1.62
golang.org/x/crypto
v0.42.0
fixed in 0.45.0
0.5%
Theoretical Threat
Post-Exploit
SUSE-SU-2026:0348-1NONE0
bind-utils
9.20.15-150700.3.12.1
fixed in 9.20.18-150700.3.15.1
Not Applicable
SUSE-SU-2026:1351-1NONE0
bind-utils
9.20.15-150700.3.12.1
fixed in 9.20.21-150700.3.18.1
Not Applicable
SUSE-SU-2025:4373-1NONE0
container-suseconnect
2.5.5-150000.4.73.1
fixed in 2.5.5-150000.4.75.1
Not Applicable
SUSE-SU-2026:0319-1NONE0
container-suseconnect
2.5.5-150000.4.73.1
fixed in 2.5.5-150000.4.77.1
Not Applicable
SUSE-SU-2026:0909-1NONE0
container-suseconnect
2.5.5-150000.4.73.1
fixed in 2.5.6-150000.4.82.1
Not Applicable
SUSE-SU-2026:1484-1NONE0
container-suseconnect
2.5.5-150000.4.73.1
fixed in 2.5.6-150000.4.84.1
Not Applicable
SUSE-SU-2026:2042-1NONE0
container-suseconnect
2.5.5-150000.4.73.1
fixed in 2.5.6-150000.4.86.1
Not Applicable
SUSE-SU-2026:2420-1NONE0
container-suseconnect
2.5.5-150000.4.73.1
fixed in 2.5.6-150000.4.88.1
Not Applicable
SUSE-SU-2026:0903-1NONE0
curl
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.14.1
Not Applicable
SUSE-SU-2025:4300-1NONE0
curl
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.5.1
Not Applicable
SUSE-SU-2026:0052-1NONE0
curl
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.8.1
Not Applicable
SUSE-SU-2026:0221-1NONE0
curl
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.11.1
Not Applicable
SUSE-SU-2026:0371-1NONE0
glibc
2.38-150600.14.37.1
fixed in 2.38-150600.14.40.1
Not Applicable
SUSE-SU-2026:1369-1NONE0
glibc
2.38-150600.14.37.1
fixed in 2.38-150600.14.46.1
Not Applicable
SUSE-SU-2026:2231-1NONE0
glibc
2.38-150600.14.37.1
fixed in 2.38-150600.14.49.1
Not Applicable
SUSE-SU-2026:0215-1NONE0
gpg2
2.4.4-150600.3.9.1
fixed in 2.4.4-150600.3.12.1
Not Applicable
SUSE-SU-2026:0434-1NONE0
gpg2
2.4.4-150600.3.9.1
fixed in 2.4.4-150600.3.15.1
Not Applicable
SUSE-SU-2026:1418-1NONE0
iproute2
6.4-150600.7.9.1
fixed in 6.4-150600.7.12.1
Not Applicable
SUSE-SU-2026:0259-1NONE0
libavahi-client3
0.8-150600.15.9.1
fixed in 0.8-150600.15.12.1
Not Applicable
SUSE-SU-2026:1441-1NONE0
libavahi-client3
0.8-150600.15.9.1
fixed in 0.8-150600.15.15.1
Not Applicable
SUSE-SU-2026:2297-1NONE0
libavahi-client3
0.8-150600.15.9.1
fixed in 0.8-150600.15.18.1
Not Applicable
SUSE-SU-2026:0259-1NONE0
libavahi-common3
0.8-150600.15.9.1
fixed in 0.8-150600.15.12.1
Not Applicable
SUSE-SU-2026:1441-1NONE0
libavahi-common3
0.8-150600.15.9.1
fixed in 0.8-150600.15.15.1
Not Applicable
SUSE-SU-2026:2297-1NONE0
libavahi-common3
0.8-150600.15.9.1
fixed in 0.8-150600.15.18.1
Not Applicable
SUSE-SU-2026:0230-1NONE0
libblkid1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.3.1
Not Applicable
SUSE-SU-2026:1406-1NONE0
libblkid1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.10.1
Not Applicable
SUSE-SU-2026:1432-1NONE0
libcap2
2.63-150400.3.3.1
fixed in 2.63-150400.3.6.1
Not Applicable
SUSE-SU-2026:0903-1NONE0
libcurl4
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.14.1
Not Applicable
SUSE-SU-2025:4300-1NONE0
libcurl4
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.5.1
Not Applicable
SUSE-SU-2026:0052-1NONE0
libcurl4
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.8.1
Not Applicable
SUSE-SU-2026:0221-1NONE0
libcurl4
8.14.1-150700.7.2.1
fixed in 8.14.1-150700.7.11.1
Not Applicable
SUSE-RU-2025:4092-1NONE0
libdw1
0.185-150400.5.3.1
fixed in 0.185-150400.5.8.3
Not Applicable
SUSE-SU-2025:4092-1NONE0
libdw1
0.185-150400.5.3.1
fixed in 0.185-150400.5.8.3
Not Applicable
SUSE-RU-2025:4092-1NONE0
libelf1
0.185-150400.5.3.1
fixed in 0.185-150400.5.8.3
Not Applicable
SUSE-SU-2025:4092-1NONE0
libelf1
0.185-150400.5.3.1
fixed in 0.185-150400.5.8.3
Not Applicable
SUSE-SU-2026:1352-1NONE0
libexpat1
2.7.1-150700.3.6.1
fixed in 2.7.1-150700.3.12.1
Not Applicable
SUSE-SU-2026:0646-1NONE0
libexpat1
2.7.1-150700.3.6.1
fixed in 2.7.1-150700.3.9.2
Not Applicable
SUSE-SU-2026:0230-1NONE0
libfdisk1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.3.1
Not Applicable
SUSE-SU-2026:1406-1NONE0
libfdisk1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.10.1
Not Applicable
SUSE-SU-2026:0018-1NONE0
libglib-2_0-0
2.78.6-150600.4.16.1
fixed in 2.78.6-150600.4.25.1
Not Applicable
SUSE-SU-2026:0373-1NONE0
libglib-2_0-0
2.78.6-150600.4.16.1
fixed in 2.78.6-150600.4.35.1
Not Applicable
SUSE-SU-2025:4308-1NONE0
libglib-2_0-0
2.78.6-150600.4.16.1
fixed in 2.78.6-150600.4.22.1
Not Applicable
SUSE-SU-2026:0286-1NONE0
libglib-2_0-0
2.78.6-150600.4.16.1
fixed in 2.78.6-150600.4.28.1
Not Applicable
SUSE-SU-2026:2115-1NONE0
libgnutls30
3.8.3-150600.4.9.1
fixed in 3.8.3-150600.4.20.1
Not Applicable
SUSE-SU-2025:4323-1NONE0
libgnutls30
3.8.3-150600.4.9.1
fixed in 3.8.3-150600.4.12.1
Not Applicable
SUSE-SU-2026:0829-1NONE0
libgnutls30
3.8.3-150600.4.9.1
fixed in 3.8.3-150600.4.17.1
Not Applicable
SUSE-SU-2026:2076-1NONE0
libldb2
4.21.8+git.418.e80c9b2a88c-150700.3.11.2
fixed in 4.21.10+git.501.277ba349a01-150700.3.26.1
Not Applicable
SUSE-SU-2026:2051-1NONE0
liblzma5
5.4.1-150600.3.3.1
fixed in 5.4.1-150600.3.6.1
Not Applicable
SUSE-SU-2026:0230-1NONE0
libmount1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.3.1
Not Applicable
SUSE-SU-2026:1406-1NONE0
libmount1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.10.1
Not Applicable
SUSE-SU-2026:1510-1NONE0
libncurses6
6.1-150000.5.30.1
fixed in 6.1-150000.5.33.1
Not Applicable
SUSE-SU-2026:1356-1NONE0
libnfsidmap1
1.0-150600.28.12.1
fixed in 1.0-150600.28.19.1
Not Applicable
SUSE-SU-2026:1074-1NONE0
libnghttp2-14
1.64.0-150700.1.5
fixed in 1.64.0-150700.3.3.1
Not Applicable
SUSE-SU-2026:0309-1NONE0
libopenssl-3-fips-provider
3.2.3-150700.5.21.1
fixed in 3.2.3-150700.5.24.1
Not Applicable
SUSE-SU-2026:1375-1NONE0
libopenssl-3-fips-provider
3.2.3-150700.5.21.1
fixed in 3.2.3-150700.5.31.1
Not Applicable
SUSE-SU-2026:1386-1NONE0
libopenssl1_1
1.1.1w-150700.11.6.1
fixed in 1.1.1w-150700.11.16.1
Not Applicable
SUSE-SU-2026:2392-1NONE0
libopenssl1_1
1.1.1w-150700.11.6.1
fixed in 1.1.1w-150700.11.22.1
Not Applicable
SUSE-SU-2026:0331-1NONE0
libopenssl1_1
1.1.1w-150700.11.6.1
fixed in 1.1.1w-150700.11.11.1
Not Applicable
SUSE-SU-2026:0309-1NONE0
libopenssl3
3.2.3-150700.5.21.1
fixed in 3.2.3-150700.5.24.1
Not Applicable
SUSE-SU-2026:1375-1NONE0
libopenssl3
3.2.3-150700.5.21.1
fixed in 3.2.3-150700.5.31.1
Not Applicable
SUSE-SU-2026:0664-1NONE0
libpython3_6m1_0
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.106.1
Not Applicable
SUSE-SU-2026:1090-1NONE0
libpython3_6m1_0
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.109.1
Not Applicable
SUSE-SU-2026:1715-1NONE0
libpython3_6m1_0
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.118.1
Not Applicable
SUSE-SU-2026:0027-1NONE0
libpython3_6m1_0
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.103.1
Not Applicable
SUSE-SU-2025:4368-1NONE0
libpython3_6m1_0
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.100.1
Not Applicable
SUSE-SU-2026:0230-1NONE0
libsmartcols1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.3.1
Not Applicable
SUSE-SU-2026:1406-1NONE0
libsmartcols1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.10.1
Not Applicable
SUSE-SU-2026:0432-1NONE0
libsqlite3-0
3.50.2-150000.3.33.1
fixed in 3.51.2-150000.3.36.1
Not Applicable
SUSE-SU-2026:1065-1NONE0
libsqlite3-0
3.50.2-150000.3.33.1
fixed in 3.51.3-150000.3.39.1
Not Applicable
SUSE-SU-2026:0779-1NONE0
libssh-config
0.9.8-150600.11.6.1
fixed in 0.9.8-150600.11.9.1
Not Applicable
SUSE-SU-2026:1310-1NONE0
libssh-config
0.9.8-150600.11.6.1
fixed in 0.9.8-150600.11.12.1
Not Applicable
SUSE-SU-2026:0779-1NONE0
libssh4
0.9.8-150600.11.6.1
fixed in 0.9.8-150600.11.9.1
Not Applicable
SUSE-SU-2026:1310-1NONE0
libssh4
0.9.8-150600.11.6.1
fixed in 0.9.8-150600.11.12.1
Not Applicable
SUSE-SU-2026:1040-1NONE0
libsystemd0
254.27-150600.4.43.3
fixed in 254.27-150600.4.62.1
Not Applicable
SUSE-SU-2026:0224-1NONE0
libtasn1
4.13-150000.4.11.1
fixed in 4.13-150000.4.14.1
Not Applicable
SUSE-SU-2026:0224-1NONE0
libtasn1-6
4.13-150000.4.11.1
fixed in 4.13-150000.4.14.1
Not Applicable
SUSE-SU-2026:1040-1NONE0
libudev1
254.27-150600.4.43.3
fixed in 254.27-150600.4.62.1
Not Applicable
SUSE-SU-2026:0230-1NONE0
libuuid1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.3.1
Not Applicable
SUSE-SU-2026:1406-1NONE0
libuuid1
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.10.1
Not Applicable
SUSE-SU-2026:0605-1NONE0
libxml2-2
2.12.10-150700.4.6.1
fixed in 2.12.10-150700.4.11.1
Not Applicable
SUSE-SU-2026:0783-1NONE0
libz1
1.2.13-150500.4.3.1
fixed in 1.2.13-150500.4.6.1
Not Applicable
SUSE-RU-2026:1228-1NONE0
login_defs
4.8.1-150600.17.9.1
fixed in 4.17.2-150600.17.18.1
Not Applicable
SUSE-SU-2026:1510-1NONE0
ncurses-utils
6.1-150000.5.30.1
fixed in 6.1-150000.5.33.1
Not Applicable
SUSE-SU-2026:1356-1NONE0
nfs-client
2.6.4-150600.28.12.1
fixed in 2.6.4-150600.28.19.1
Not Applicable
SUSE-SU-2026:0309-1NONE0
openssl-3
3.2.3-150700.5.21.1
fixed in 3.2.3-150700.5.24.1
Not Applicable
SUSE-SU-2026:1375-1NONE0
openssl-3
3.2.3-150700.5.21.1
fixed in 3.2.3-150700.5.31.1
Not Applicable
SUSE-SU-2026:0664-1NONE0
python3-base
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.106.1
Not Applicable
SUSE-SU-2026:1090-1NONE0
python3-base
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.109.1
Not Applicable
SUSE-SU-2026:1715-1NONE0
python3-base
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.118.1
Not Applicable
SUSE-SU-2026:0027-1NONE0
python3-base
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.103.1
Not Applicable
SUSE-SU-2025:4368-1NONE0
python3-base
3.6.15-150300.10.97.1
fixed in 3.6.15-150300.10.100.1
Not Applicable
SUSE-SU-2026:2076-1NONE0
samba-client-libs
4.21.8+git.418.e80c9b2a88c-150700.3.11.2
fixed in 4.21.10+git.501.277ba349a01-150700.3.26.1
Not Applicable
SUSE-SU-2026:1941-1NONE0
sed
4.9-150600.1.4
fixed in 4.9-150600.3.3.1
Not Applicable
SUSE-RU-2026:1228-1NONE0
shadow
4.8.1-150600.17.9.1
fixed in 4.17.2-150600.17.18.1
Not Applicable
SUSE-SU-2026:1040-1NONE0
systemd
254.27-150600.4.43.3
fixed in 254.27-150600.4.62.1
Not Applicable
SUSE-SU-2026:1177-1NONE0
tar
1.34-150000.3.34.1
fixed in 1.34-150000.3.37.1
Not Applicable
SUSE-SU-2026:1510-1NONE0
terminfo-base
6.1-150000.5.30.1
fixed in 6.1-150000.5.33.1
Not Applicable
SUSE-SU-2026:0230-1NONE0
util-linux
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.3.1
Not Applicable
SUSE-SU-2026:1406-1NONE0
util-linux
2.40.4-150700.2.4
fixed in 2.40.4-150700.4.10.1
Not Applicable
CVE-2026-39823NONE0
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.3%
Theoretical Threat
Not Applicable
CVE-2026-39825NONE0
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Not Applicable
CVE-2026-42499NONE0
stdlib
v1.25.3
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-42504NONE0
stdlib
v1.25.3
fixed in 1.25.11, 1.26.4
0.4%
Theoretical Threat
Not Applicable
CVE-2026-27145NONE0
stdlib
v1.25.3
fixed in 1.25.11, 1.26.4
0.3%
Theoretical Threat
Not Applicable
CVE-2026-42507NONE0
stdlib
v1.25.3
fixed in 1.25.11, 1.26.4
0.3%
Theoretical Threat
Not Applicable