Vulnerability Reportprom/alertmanager:v0.34.2

prom/alertmanager:latestprom/alertmanager:v0prom/alertmanager:v0.34.2

digestsha256:39d8bb3966c694a124428a3a88fbcffd40bd069129ecd47c059f8a3f17c55f3b

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found one reachable-from-the-network weakness of low severity, which does not raise the risk of this image.• No known-exploited vulnerabilities were found in the scan results.• No findings matter only after the container is already compromised.• The image is pinned by digest and comes from a popular community publisher with a RELIABLE trust verdict.• The container runs as the unprivileged nobody user and exposes a single port (9093/tcp).

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (492M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found one low-severity issue (exposed maximum severity 4.0) that is not reachable in a way that changes the risk picture, and nothing in the results is known to be actively exploited. Because the threat score is in the lowest band and the image runs as an unprivileged user, the remaining item does not affect the production decision, although routine patching remains good hygiene.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.