Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. A remote attacker reaching the HTTPS port could exhaust CPU or memory, crashing or degrading the Portainer service that manages the containers behind it. The scan found 66 exposed findings in total, 7 of them at severity 7.0 or higher, and none are known to be actively exploited. Note: CVE-2026-56858 only applies when server-side templates render attacker-controlled data in a vulnerable pattern, so its relevance depends on how the application is built. The publisher is rated TRUSTED, but patching the affected Go components remains necessary before production use.
Hardening plan for this image · 4 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78669 | HIGH7.5 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78659 | HIGH7.5 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56862 | HIGH7.5 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78667 | HIGH7.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78669 | HIGH7.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78659 | HIGH7.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-94440 | HIGH7.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56858 | MEDIUM6.48 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78660 | MEDIUM6 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84304 | MEDIUM6 | google.golang.org/grpc v1.82.1 fixed in 1.83.1 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33818 | MEDIUM6 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56853 | MEDIUM6 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56860 | MEDIUM6 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78660 | MEDIUM6 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM5.9 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-33747 | MEDIUM5.88 | github.com/moby/buildkit v0.25.1 fixed in 0.28.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-71556 | MEDIUM5.68 | github.com/go-git/go-git/v5 v5.19.1 fixed in 5.19.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-61801 | MEDIUM5.5 | github.com/moby/sys/user v0.4.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.26.4 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM5.3 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56865 | MEDIUM5.28 | golang.org/x/mod v0.37.0 fixed in 0.40.0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-85731 | MEDIUM5.28 | oras.land/oras-go/v2 v2.6.1 fixed in 2.6.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | MEDIUM5.2 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-71557 | MEDIUM5.04 | github.com/go-git/go-git/v5 v5.19.1 fixed in 5.19.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84303 | MEDIUM5.04 | google.golang.org/grpc v1.82.1 fixed in 1.83.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-39821 | MEDIUM4.92 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-97030 | MEDIUM4.88 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33997 | MEDIUM4.86 | github.com/docker/docker v28.5.2+incompatible fixed in 29.3.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56864 | MEDIUM4.86 | golang.org/x/mod v0.37.0 fixed in 0.40.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-15558 | MEDIUM4.8 | github.com/docker/cli v28.5.1+incompatible fixed in 29.2.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-95837 | MEDIUM4.68 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.2.7, 2.3.4 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-17106 | MEDIUM4.68 | github.com/moby/go-archive v0.1.0 fixed in 0.3.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39822 | MEDIUM4.68 | stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-63209 | MEDIUM4.5 | github.com/klauspost/compress v1.18.5 fixed in 1.18.7 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33748 | MEDIUM4.5 | github.com/moby/buildkit v0.25.1 fixed in 0.28.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56851 | MEDIUM4.5 | golang.org/x/text v0.40.0 fixed in 0.41.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84445 | MEDIUM4.5 | google.golang.org/grpc v1.82.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-97031 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41567 | MEDIUM4.32 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-42306 | MEDIUM4.32 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-50163 | MEDIUM4.26 | oras.land/oras-go/v2 v2.6.1 fixed in 2.6.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-85747 | MEDIUM4.08 | github.com/docker/distribution v2.8.3+incompatible No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56854 | MEDIUM4.08 | golang.org/x/crypto v0.54.0 fixed in 0.55.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-61711 | LOW3.78 | github.com/moby/buildkit v0.25.1 fixed in 0.31.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41568 | LOW3.6 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-53495 | LOW3.3 | github.com/containerd/containerd v1.7.33 fixed in 1.7.35 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-53495 | LOW3.3 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-61712 | LOW3.3 | github.com/moby/buildkit v0.25.1 fixed in 0.31.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/sdk v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-53493 | LOW3.18 | github.com/containerd/containerd v1.7.33 fixed in 1.7.36 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-53493 | LOW3.18 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.13, 2.2.9, 2.3.6, 2.4.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56855 | LOW3.18 | golang.org/x/crypto v0.54.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78662 | LOW3.18 | golang.org/x/crypto v0.54.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-85732 | LOW2.82 | oras.land/oras-go/v2 v2.6.1 fixed in 2.6.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-46600 | LOW2.7 | stdlib v1.26.4 fixed in 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-56859 | LOW2.7 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | LOW2.4 | golang.org/x/crypto v0.54.0 No fix yet | — | Directly Exposed |
| CVE-2026-95838 | LOW1.98 | github.com/containerd/containerd v1.7.33 fixed in 1.7.35 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95838 | LOW1.98 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5 | 0.2% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.