Vulnerability Reportprom/blackbox-exporter:latest

prom/blackbox-exporter:latestprom/blackbox-exporter:v0prom/blackbox-exporter:v0-busyboxprom/blackbox-exporter:latest-busyboxprom/blackbox-exporter:v0.29.1prom/blackbox-exporter:v0.29.1-busybox

digestsha256:ea1c7aa3ef3f307cd03e85f34abb604478ccb90b567fc690da0cd9776da76b13

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreSAFE• Threat score is 0, which falls in the SAFE band (0 to 24).• Stats show 1 exposed-surface finding with a maximum severity of 4.0, and no known-exploited findings.• No post-exploit-only findings are reported.• No high-impact or actively exploited CVEs appear in the provided findings, so none drive the verdict.• Publisher trust is rated RELIABLE with a score of 90, and the image is pinned by digest.• The container runs as root by default, which is a hardening consideration but was not scored as a vulnerability.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (209M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan reports one exposed-surface finding, but its severity is low (maximum 4.0), it is not known to be actively exploited, and it does not affect the verdict. The image comes from a well-established publisher and is pinned by digest, which supports immutable deployments. Running as root is worth reducing through standard hardening, such as a non-root user and restricted capabilities, though it is not a flaw that changes this verdict.

Relevant for prom/blackbox-exporter:latest

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.