Vulnerability Reportprom/mysqld-exporter:v0.21.0

prom/mysqld-exporter:latestprom/mysqld-exporter:v0prom/mysqld-exporter:v0-busyboxprom/mysqld-exporter:latest-busyboxprom/mysqld-exporter:v0.21.0prom/mysqld-exporter:v0.21.0-busybox

digestsha256:afad0c59a154fea24ca5ea0e6f95f2b0b168601b111266963dc8a347715b5318

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreSAFE• The threat score is 0, which falls in the SAFE band, and none of the escalation conditions apply.• One exposed-surface vulnerability was detected, with a maximum severity of 4.0, which is below the thresholds that would raise the verdict.• No known-exploited vulnerabilities are associated with the exposed surface, and no post-exploitation-only findings were reported.• The image is published by prom, rated RELIABLE with a trust score of 90, and pinned by digest for immutability.• The container runs as the unprivileged user nobody and exposes only port 9104/tcp for the exporter service.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (79M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. One low-severity exposed-surface finding (maximum severity 4.0) was detected, but it does not affect the verdict because its severity is low and it is not known to be actively exploited. The image comes from a widely used, reliable publisher and is pinned by digest, which reduces the risk of unexpected changes. It runs as the unprivileged nobody user and exposes only the exporter port, which limits the impact of any future issue.

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.