Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2026-17106, which could let a crafted archive uploaded to Portainer write files to paths the container process can reach. Note: CVE-2026-17106 only applies if Portainer is used to extract archives from untrusted sources, so its relevance depends on how your deployment handles uploads. Overall the findings are limited in count and severity, and the trusted publisher and digest pinning further support production use once the affected library is updated.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-17106 | MEDIUM6.24 | github.com/moby/go-archive v0.1.0 fixed in 0.3.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33747 | MEDIUM5.88 | github.com/moby/buildkit v0.25.1 fixed in 0.28.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-61801 | MEDIUM5.5 | github.com/moby/sys/user v0.4.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-85747 | MEDIUM5.44 | github.com/docker/distribution v2.8.3+incompatible No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33997 | MEDIUM4.86 | github.com/docker/docker v28.5.2+incompatible fixed in 29.3.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-15558 | MEDIUM4.8 | github.com/docker/cli v28.5.1+incompatible fixed in 29.2.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-95837 | MEDIUM4.68 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.2.7, 2.3.4 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-33748 | MEDIUM4.5 | github.com/moby/buildkit v0.25.1 fixed in 0.28.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41567 | MEDIUM4.32 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-42306 | MEDIUM4.32 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-61711 | LOW3.78 | github.com/moby/buildkit v0.25.1 fixed in 0.31.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41568 | LOW3.6 | github.com/docker/docker v28.5.2+incompatible No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-53495 | LOW3.3 | github.com/containerd/containerd v1.7.33 fixed in 1.7.35 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-53495 | LOW3.3 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-61712 | LOW3.3 | github.com/moby/buildkit v0.25.1 fixed in 0.31.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/sdk v1.44.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53493 | LOW3.18 | github.com/containerd/containerd v1.7.33 fixed in 1.7.36 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-53493 | LOW3.18 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.13, 2.2.9, 2.3.6, 2.4.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95838 | LOW1.98 | github.com/containerd/containerd v1.7.33 fixed in 1.7.35 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95838 | LOW1.98 | github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5 | 0.2% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.