Vulnerability Reportprom/alertmanager:v0.33.1

prom/alertmanager:v0.33.1

digestsha256:9e082985f56f4c8c9f724e18f2288c6708f472e56a5286b8863d080434ea065d

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-56858 in the Go standard library (stdlib) could let crafted alert or label content run script in an operator's browser through the web UI on port 9093, with a severity of 6.48.• The scan found 50 exposed-surface vulnerabilities in total, 8 of them rated 6.0 or higher, and none are listed as known to be actively exploited.• Several denial-of-service flaws, such as CVE-2026-33818 and CVE-2026-56860, can slow or crash the service when reached over the network, but they do not expose data or allow code execution.• Some of the findings only apply when TLS or HTTP/2 is turned on, as with CVE-2026-56862, so they may not affect a plain HTTP deployment.• Nothing in the scan is rated at severity 7.0 or higher, and the post-exploit findings are low (highest 2.7), so they add little risk on their own.• The image comes from a popular community publisher with a RELIABLE trust verdict and is pinned by digest, which supports its origin but does not remove the need to patch.

33/100NEEDS ATTENTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (492M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is a cross-site scripting issue (CVE-2026-56858) in the Go standard library that could affect operators viewing crafted alert content in the web UI. Most other findings are denial-of-service flaws that could tie up CPU or memory, and several only matter when TLS or HTTP/2 is enabled, which is worth confirming in your configuration. Because none of these are rated high or known to be exploited, they do not block production use, but updating the Go standard library in a future image build would address the whole group.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

60 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-56858	MEDIUM6.48	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-33818	MEDIUM6	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56860	MEDIUM6	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56862	MEDIUM6	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78667	MEDIUM6	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78669	MEDIUM6	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97031	MEDIUM6	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.9	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-42505	MEDIUM5.3	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM5.3	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-39828	MEDIUM5.28	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.4% Theoretical Threat	Directly Exposed
GHSA-hrxh-6v49-42gf	MEDIUM5.28	google.golang.org/grpc v1.80.0 fixed in 1.82.1	—	Directly Exposed
CVE-2026-56865	MEDIUM5.28	golang.org/x/mod v0.35.0 fixed in 0.40.0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-39832	MEDIUM5.22	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-39821	MEDIUM4.92	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	1.8% Low-Moderate Risk	Directly Exposed
CVE-2026-39831	MEDIUM4.86	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-56864	MEDIUM4.86	golang.org/x/mod v0.35.0 fixed in 0.40.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-39822	MEDIUM4.68	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.2% Theoretical Threat	Directly Exposed
CVE-2026-63209	MEDIUM4.5	github.com/klauspost/compress v1.18.6 fixed in 1.18.7	0.6% Theoretical Threat	Directly Exposed
CVE-2026-39829	MEDIUM4.5	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-39830	MEDIUM4.5	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-39835	MEDIUM4.5	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-46597	MEDIUM4.5	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-56851	MEDIUM4.5	golang.org/x/text v0.37.0 fixed in 0.41.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-56852	MEDIUM4.5	golang.org/x/text v0.37.0 fixed in 0.39.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-84304	MEDIUM4.5	google.golang.org/grpc v1.80.0 fixed in 1.83.1	0.6% Theoretical Threat	Directly Exposed
CVE-2026-84445	MEDIUM4.5	google.golang.org/grpc v1.80.0 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56853	MEDIUM4.5	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94440	MEDIUM4.5	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-42508	MEDIUM4.44	golang.org/x/crypto v0.51.0 fixed in 0.52.0	6.9% Low-Moderate Risk	Directly Exposed
CVE-2026-46595	MEDIUM4.26	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56854	MEDIUM4.08	golang.org/x/crypto v0.51.0 fixed in 0.55.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-111943	MEDIUM4.08	stdlib v1.26.4 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-39827	LOW3.9	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-39834	LOW3.9	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94439	LOW3.9	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-84303	LOW3.78	google.golang.org/grpc v1.80.0 fixed in 1.83.1	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-39833	LOW3.3	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/sdk v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-46598	LOW3.18	golang.org/x/crypto v0.51.0 fixed in 0.52.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56855	LOW3.18	golang.org/x/crypto v0.51.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	LOW3.18	golang.org/x/crypto v0.51.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-46600	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.56.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-78669	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78659	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78660	LOW2.7	golang.org/x/net v0.55.0 fixed in 0.60.0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-46600	LOW2.7	stdlib v1.26.4 fixed in 1.26.6, 1.27.0-rc.3	0.5% Theoretical Threat	Post-Exploit
CVE-2026-56859	LOW2.7	stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78660	LOW2.7	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Post-Exploit
GO-2026-5932	LOW2.4	golang.org/x/crypto v0.51.0 No fix yet	—	Directly Exposed
CVE-2026-56866	LOW2.34	stdlib v1.26.4 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Post-Exploit
CVE-2026-97032	LOW2.12	golang.org/x/net v0.55.0 fixed in 0.60.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-78663	LOW1.91	golang.org/x/net v0.55.0 fixed in 0.60.0	0.6% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.