Vulnerability Reportmilvusdb/milvus:2.6-20260618-5074b358-amd64

milvusdb/milvus:2.6-20260618-5074b358-amd64
digestsha256:938d5b40563973641d3787ae71febdc2fe2e5f4dbae7f30d4677208cbdcf4444

Executive Summary

Last scanned:

Threat Score
50/100CAUTION
Reputation
RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The most severe real-world consequence an attacker could achieve is denial of service against the Milvus service, potentially causing downtime, by exploiting DoS vulnerabilities in krb5 (CVE-2026-40355) and OpenTelemetry (CVE-2026-29181). These vulnerabilities are remotely exploitable with no authentication. Mitigations include ensuring no NegoEx mechanism is registered on the system (eliminating krb5 risk) and restricting the number of baggage headers via a WAF or proxy to protect against the OpenTelemetry DoS.

Vulnerabilities

Vulnerability Log

125 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-40355MEDIUM6.38
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-29181MEDIUM6.38
go.opentelemetry.io/otel
v1.40.0
fixed in 1.41.0
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-39882MEDIUM6.38
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
v1.20.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39830MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-39835MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46597MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-33814MEDIUM6.38
golang.org/x/net
v0.48.0
fixed in 0.53.0
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32283MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-33814MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-39836MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42499MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-42504MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42508MEDIUM6.29
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-46595MEDIUM6.03
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-39883MEDIUM5.95
go.opentelemetry.io/otel/sdk
v1.40.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2024-2236MEDIUM5.9
libgcrypt20
1.9.4-3ubuntu3.2
No fix yet
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2026-39821MEDIUM5.58
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-6238MEDIUM5.52
libc-bin
2.35-0ubuntu3.13
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-6238MEDIUM5.52
libc6
2.35-0ubuntu3.13
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39827MEDIUM5.52
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39834MEDIUM5.52
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-25680MEDIUM5.52
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39825MEDIUM5.52
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32282MEDIUM5.44
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42502MEDIUM5.18
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-32289MEDIUM5.18
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-27145MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.9%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32280MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32281MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-33811MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5435MEDIUM5.02
libc-bin
2.35-0ubuntu3.13
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-5435MEDIUM5.02
libc6
2.35-0ubuntu3.13
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgcc-s1
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgfortran5
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgomp1
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libquadmath0
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libstdc++6
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-39833MEDIUM4.67
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32288MEDIUM4.67
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-58055MEDIUM4.59
libnghttp2-14
1.43.0-1ubuntu0.3
fixed in 1.43.0-1ubuntu0.4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42506MEDIUM4.59
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39823MEDIUM4.59
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39826MEDIUM4.59
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc-bin
2.35-0ubuntu3.13
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc6
2.35-0ubuntu3.13
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46598MEDIUM4.5
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42505MEDIUM4.5
stdlib
v1.25.8
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42507MEDIUM4.5
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libblkid1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libmount1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libsmartcols1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libuuid1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-9547LOW3.77
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8924LOW3.31
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-8924LOW3.31
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
perl-base
5.34.0-3ubuntu1.5
fixed in 5.34.0-3ubuntu1.7
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8925LOW2.92
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-8925LOW2.92
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2025-45582LOW2.86
tar
1.34+dfsg-1ubuntu0.1.22.04.2
fixed in 1.34+dfsg-1ubuntu0.1.22.04.4
0.4%
Theoretical Threat
Post-Exploit
CVE-2022-27943LOW2.8
gcc-12-base
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-5704LOW2.8
tar
1.34+dfsg-1ubuntu0.1.22.04.2
fixed in 1.34+dfsg-1ubuntu0.1.22.04.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-40228LOW2.8
libsystemd0
249.11-0ubuntu3.21
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libudev1
249.11-0ubuntu3.21
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42496LOW2.78
perl-base
5.34.0-3ubuntu1.5
fixed in 5.34.0-3ubuntu1.7
0.4%
Theoretical Threat
Post-Exploit
CVE-2022-4899LOW2.7
libzstd1
1.4.8+dfsg-3build1
No fix yet
1.6%
Low-Moderate Risk
Post-Exploit
CVE-2026-41602LOW2.7
github.com/apache/thrift
v0.20.0
fixed in 0.23.0
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-39828LOW2.69
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-39832LOW2.66
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8286LOW2.48
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8286LOW2.48
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39831LOW2.48
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-25681LOW2.48
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27136LOW2.48
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
bsdutils
1:2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-41991LOW2.4
gzip
1.10-4ubuntu4.1
fixed in 1.10-4ubuntu4.2
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
mount
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
util-linux
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-39822LOW2.39
stdlib
v1.25.8
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-8927LOW2.29
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-41992LOW2.29
gzip
1.10-4ubuntu4.1
fixed in 1.10-4ubuntu4.2
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-8927LOW2.29
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.8%
Theoretical Threat
Post-Exploit
CVE-2022-41409LOW2.29
libpcre2-8-0
10.39-3ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Post-Exploit
CVE-2026-39829LOW2.29
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-39820LOW2.29
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-9547LOW2.26
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
login
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2023-29383LOW1.68
login
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2023-29383LOW1.68
passwd
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2025-69720NONE0
libncurses6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libncursesw6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libtinfo6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-base
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-bin
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libncurses6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libncursesw6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libtinfo6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
ncurses-base
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
ncurses-bin
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2026-13757NONE0
libp11-kit0
0.24.0-6build1
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules-bin
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-runtime
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam0g
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-8458NONE0
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Not Applicable
CVE-2026-8458NONE0
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
v1.6.7
fixed in 1.7.8
—
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/service/bedrockruntime
v1.23.0
fixed in 1.50.4
—
Not Applicable
CVE-2026-2303NONE0
go.mongodb.org/mongo-driver
v1.13.1
fixed in 1.17.7
0.2%
Theoretical Threat
Not Applicable
GO-2026-5932NONE0
golang.org/x/crypto
v0.46.0
No fix yet
—
Not Applicable
CVE-2026-46600NONE0
golang.org/x/net
v0.48.0
fixed in 0.56.0
—
Not Applicable
CVE-2026-39824NONE0
golang.org/x/sys
v0.40.0
fixed in 0.44.0
0.1%
Theoretical Threat
Not Applicable
CVE-2026-56852NONE0
golang.org/x/text
v0.32.0
fixed in 0.39.0
—
Not Applicable
GHSA-hrxh-6v49-42gfNONE0
google.golang.org/grpc
v1.79.3
fixed in 1.82.1
—
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.