Vulnerability Reportprom/node-exporter:v1.12.1

prom/node-exporter:latestprom/node-exporter:v1prom/node-exporter:v1-busyboxprom/node-exporter:latest-busyboxprom/node-exporter:v1.12.1prom/node-exporter:v1.12.1-busybox

digestsha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-78669 in golang.org/x/net could let an HTTP/2 client consume exporter CPU and stall metric scrapes, but only when TLS is enabled in the exporter's web config, which is not the default.• The scan found 31 exposed findings in total, 7 at severity 6.0 or higher, and none at 7.0 or higher and none listed as known exploited.• CVE-2026-78659 (golang.org/x/net) and CVE-2026-56853 (stdlib) are denial-of-service flaws that mainly threaten metric availability, and both need HTTP/2 to be enabled in a non-default configuration.• CVE-2026-56862 and CVE-2026-97031 (stdlib) affect the TLS handshake and only apply when TLS is enabled on the exporter, so they do not apply in the default plain-HTTP setup.• The one finding that matters only after a container compromise has a low severity of 2.34, so it has little bearing on this verdict.• The image comes from a popular community publisher with a RELIABLE trust verdict, is pinned by digest, and runs as the unprivileged nobody user.

32/100NEEDS ATTENTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (4014M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The findings are denial-of-service issues, meaning the worst outcome is slowed or stalled metric scrapes and exporter memory or CPU exhaustion, not data theft or code execution. Note: CVE-2026-78669 and CVE-2026-56862 only apply when TLS or HTTP/2 is enabled in the exporter's web config, which is not the default, so keeping the default plain-HTTP setup avoids those paths. Upgrading the Go standard library and golang.org/x/net packages to fixed versions is the practical way to clear these seven medium-severity findings.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

32 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM6	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56853	MEDIUM6	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56862	MEDIUM6	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78669	MEDIUM6	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97031	MEDIUM6	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.9	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM5.3	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94439	MEDIUM5.2	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-39821	MEDIUM4.92	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	1.8% Low-Moderate Risk	Directly Exposed
CVE-2026-56858	MEDIUM4.86	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM4.72	golang.org/x/net v0.57.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56851	MEDIUM4.5	golang.org/x/text v0.40.0 fixed in 0.41.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-33818	MEDIUM4.5	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-46600	MEDIUM4.5	stdlib v1.26.5 fixed in 1.26.6, 1.27.0-rc.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-56859	MEDIUM4.5	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56860	MEDIUM4.5	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM4.5	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-94440	MEDIUM4.5	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.24	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56854	MEDIUM4.08	golang.org/x/crypto v0.54.0 fixed in 0.55.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-111943	MEDIUM4.08	stdlib v1.26.5 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56855	LOW3.18	golang.org/x/crypto v0.54.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	LOW3.18	golang.org/x/crypto v0.54.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
GO-2026-5932	LOW2.4	golang.org/x/crypto v0.54.0 No fix yet	—	Directly Exposed
CVE-2026-56866	LOW2.34	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.