Vulnerability Reportprom/prometheus:v3.15.1

prom/prometheus:v3.15.1prom/prometheus:v3.15.1-busybox

digestsha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2

Executive Summary

Last scanned: Nov 7, 2026

Threat ScoreSAFE• The scan found one reachable-from-network issue with a maximum severity of 4.0, which is low and does not set the verdict.• No known-exploited vulnerabilities were found, and nothing that matters only after compromise was flagged.• The image runs as the unprivileged nobody user and exposes only the Prometheus port 9090/tcp.• The image is a popular community publication pinned by digest, with a reliability verdict of RELIABLE; this is context only and did not change the verdict.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (2038M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found one low-severity finding that is reachable from the network but rates only 4.0 at most and carries no known exploitation, so it does not affect the verdict. The container runs as the unprivileged nobody user and exposes only the Prometheus port, which keeps the attack surface small. Routine patching and monitoring of new advisories remain good practice.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.