Vulnerability Reportopenpolicyagent/gatekeeper:v3.23.1

openpolicyagent/gatekeeper:v3.23.1

digestsha256:dfc6fc78753f5564303429c1c1fdfe611df17be224ab22c09ce9d2a73c468a8d

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-78669 in golang.org/x/net (and the Go standard library) lets a cluster client exhaust controller CPU with excessive HTTP/2 SETTINGS frames, slowing admission responses; the scan rates it at 6.0.• Four medium-severity denial-of-service findings were found in total, with a maximum severity of 6.0, and none are known to be actively exploited.• Both CVE-2026-78669 and CVE-2026-78659 apply only if the webhook server negotiates HTTP/2, which the provided context does not confirm.• CVE-2026-78659 could exhaust controller memory with crafted trailer headers, possibly restarting the admission webhook, which affects availability rather than data or access.• The one post-exploit finding has a maximum severity of 2.7 and matters only after the container is already compromised, so it does not drive this result.• The image comes from a publisher the reputation check rates TRUSTED, is pinned by digest, and the main binary is statically linked, so OS library flaws are not reachable through it.

27/100NEEDS ATTENTION

ReputationSPONSORED OSS• Docker Sponsored OSS (Trusted Community)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan found several denial-of-service flaws in the Go HTTP/2 stack, most notably CVE-2026-78669, which a cluster client could use to slow the admission webhook by consuming CPU. These issues cause availability problems rather than data theft or code execution, and none are known to be actively exploited. Note: CVE-2026-78669 and CVE-2026-78659 only apply if the webhook server negotiates HTTP/2, so confirming that setting is the first step in judging real exposure. Updating the golang.org/x/net and Go standard library packages to fixed versions is the straightforward way to clear these findings.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

32 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM6	golang.org/x/net v0.56.0 fixed in 0.60.0	0.8% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	golang.org/x/net v0.56.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78669	MEDIUM6	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.8% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.9% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.9	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly Exposed
CVE-2026-111943	MEDIUM5.44	stdlib v1.26.6 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78663	MEDIUM5.3	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.9% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM4.72	golang.org/x/net v0.56.0 fixed in 0.60.0	0.7% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.56.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-84304	MEDIUM4.5	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.6% Theoretical Threat	Directly Exposed
CVE-2026-84445	MEDIUM4.5	google.golang.org/grpc v1.82.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM4.5	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM4.5	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-94440	MEDIUM4.5	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.24	golang.org/x/net v0.56.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56854	MEDIUM4.08	golang.org/x/crypto v0.53.0 fixed in 0.55.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56866	LOW3.9	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94439	LOW3.9	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-84303	LOW3.78	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/sdk v1.44.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.26.6 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56855	LOW3.18	golang.org/x/crypto v0.53.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	LOW3.18	golang.org/x/crypto v0.53.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56851	LOW2.7	golang.org/x/text v0.39.0 fixed in 0.41.0	0.5% Theoretical Threat	Post-Exploit
GO-2026-5932	LOW2.4	golang.org/x/crypto v0.53.0 No fix yet	—	Directly Exposed
DLA-4792-1	NONE0	tzdata 2026b-0+deb12u1 fixed in 2026c-0+deb12u1	—	Not Applicable
DLA-4854-1	NONE0	tzdata 2026b-0+deb12u1 fixed in 2026e-0+deb12u1	—	Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.