Vulnerability Reportruby:3

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most impactful exposed issue is CVE-2026-49261, where MariaDB can execute arbitrary commands via wsrep_notify_cmd if that feature is enabled; disabling wsrep_notify_cmd fully mitigates it, and CVE-2026-44172 is a SQL injection risk in MariaDB client handling. An attacker exploiting these inherited issues could run arbitrary code or inject SQL, potentially leading to data exposure or service compromise in downstream images. Post-exploit-only findings are low severity (max 4.13), so the main concern is the exposed high-severity surface. Note that CVE-2026-49261 only applies when wsrep_notify_cmd is enabled. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.