Vulnerability Reportportainer/portainer-ce:2.45.3-alpine

portainer/portainer-ce:alpine-stsportainer/portainer-ce:alpineportainer/portainer-ce:2.45.3-alpine

digestsha256:3d2e116d0aab38f13ee2b893e4fd931e69a09574eee0b597711a68d76754cce1

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-17106 in the github.com/moby/go-archive package (installed v0.1.0) is the top concern: a crafted archive processed during tar extraction could write files to unintended writable paths in the container.• The scan found 24 exposed findings, and only one reaches a severity of 6.0 or higher, with a maximum of 6.24.• The flaw only matters if an authenticated user can upload or import archives through a feature that uses this extraction code, which is a non-default configuration.• None of the findings are listed as known to be actively exploited, and the scan found no post-exploitation-only findings.• The publisher reputation verdict is TRUSTED and the image is pinned by digest, which supports provenance but does not change the vulnerability assessment.

26/100NEEDS ATTENTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main item is CVE-2026-17106 in the go-archive library, which could let a crafted archive overwrite files in the container if an archive upload or import path is used. That path depends on Portainer's own configuration, so the risk is conditional rather than automatic. Not exposing archive upload or import features would remove this exposure entirely, and updating the go-archive dependency once a fixed version is available would also address it.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

24 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-17106	MEDIUM6.24	github.com/moby/go-archive v0.1.0 fixed in 0.3.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-33747	MEDIUM5.88	github.com/moby/buildkit v0.25.1 fixed in 0.28.1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-61801	MEDIUM5.5	github.com/moby/sys/user v0.4.0 fixed in 0.4.1	0.1% Theoretical Threat	Directly Exposed
CVE-2026-33997	MEDIUM4.86	github.com/docker/docker v28.5.2+incompatible fixed in 29.3.1	0.4% Theoretical Threat	Directly Exposed
CVE-2025-15558	MEDIUM4.8	github.com/docker/cli v28.5.1+incompatible fixed in 29.2.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-95837	MEDIUM4.68	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.2.7, 2.3.4	0.1% Theoretical Threat	Directly Exposed
CVE-2026-33748	MEDIUM4.5	github.com/moby/buildkit v0.25.1 fixed in 0.28.1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-41567	MEDIUM4.32	github.com/docker/docker v28.5.2+incompatible No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-42306	MEDIUM4.32	github.com/docker/docker v28.5.2+incompatible No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-85747	MEDIUM4.08	github.com/docker/distribution v2.8.3+incompatible No fix yet	0.2% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed
CVE-2026-61711	LOW3.78	github.com/moby/buildkit v0.25.1 fixed in 0.31.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-41568	LOW3.6	github.com/docker/docker v28.5.2+incompatible No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-53495	LOW3.3	github.com/containerd/containerd v1.7.33 fixed in 1.7.35	0.2% Theoretical Threat	Directly Exposed
CVE-2026-53495	LOW3.3	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5	0.2% Theoretical Threat	Directly Exposed
CVE-2026-61712	LOW3.3	github.com/moby/buildkit v0.25.1 fixed in 0.31.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/sdk v1.44.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-53493	LOW3.18	github.com/containerd/containerd v1.7.33 fixed in 1.7.36	0.4% Theoretical Threat	Directly Exposed
CVE-2026-53493	LOW3.18	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.13, 2.2.9, 2.3.6, 2.4.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-95838	LOW1.98	github.com/containerd/containerd v1.7.33 fixed in 1.7.35	0.2% Theoretical Threat	Directly Exposed
CVE-2026-95838	LOW1.98	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5	0.2% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.