Vulnerability Reportnewrelic/infrastructure-bundle:latest

newrelic/infrastructure-bundle:latest

digestsha256:ad769f8673d2e4a34dd55845ef8b436c91aeea7892d6b109df43253c198adb38

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreSAFE• The scan found 3 exposed issues, and the highest severity among them is 5.5, which is moderate and does not change the verdict.• None of the exposed issues are listed as known to be actively exploited in the wild.• The main process is a statically linked Go program that does not load system shared libraries, so flaws in the OS libraries are not reachable through it.• No issues were found that matter only after the container is already compromised.• The publisher is verified, the trust verdict is TRUSTED, and the image is pinned by digest, so its contents are immutable.• The container runs as root by default, so tightening its user settings is a reasonable hardening step even though no finding requires it.

1/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan did find 3 exposed issues, but the highest severity is 5.5 and none are known to be actively exploited, so they do not drive the verdict. The main program is a statically linked Go binary that does not load system libraries, which keeps OS-level flaws out of its reachable attack path. The image comes from a verified publisher and is pinned by digest. Running as root by default is worth tightening as routine hardening, and the remaining low-severity issues can be addressed during normal maintenance.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

3 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-10722	MEDIUM5.5	github.com/cilium/ebpf v0.19.0 fixed in 0.22.0	0.2% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.