Vulnerability Reportsonatype/gitlab-nexus-iq-pipeline:latest

sonatype/gitlab-nexus-iq-pipeline:latestsonatype/gitlab-nexus-iq-pipeline:2.15.0-01

digestsha256:d55c91abda5769fd0b3db08b0f0bad95ea7644085af035a7d9f95b619889eac0

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreCAUTION• One exposed-surface finding has a maximum severity of 7.45, which drives the CAUTION band.• CVE-2026-111497 (brotli-libs, out-of-bounds write in the Brotli decoder) is rated RCE-capable but has contextImportance MEDIUM.• The image exposes no ports and has no known exploited vulnerabilities (exposed_known_exploited is 0).• The image runs as root by default, which increases the impact of any code execution.• 39 post-exploit-only findings exist, with a maximum severity of 2.92, and they do not change the verdict.• The publisher is verified (sonatype) and the image is pinned by digest, which reduces supply-chain concern.

54/100CAUTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The main concern is CVE-2026-111497, where crafted compressed data from a remote server could crash or corrupt the scanner process and possibly enable code execution. Its stated importance is MEDIUM and no special configuration is required, so it applies in normal operation when the scanner processes responses from remote servers. Because the container runs as root by default, any code execution would carry more weight. The 39 post-exploit-only findings are low severity (maximum 2.92) and do not drive this verdict, though they still add to the overall exposure. Teams should weigh this residual risk against their controls before deploying.

Vulnerabilities

Vulnerability Log

40 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-111497	HIGH7.45	brotli-libs 1.2.0-r1 fixed in 1.2.1-r0	36.0% High Exploitation Risk	Directly ExposedContext importance: MEDIUM
CVE-2026-92392	LOW2.92	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-78669	LOW2.7	docker-cli 29.8.2-r1 fixed in 29.9.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-78659	LOW2.7	docker-cli 29.8.2-r1 fixed in 29.9.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-105482	LOW2.66	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-105483	LOW2.66	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-106069	LOW2.66	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-111943	LOW2.45	docker-cli 29.8.2-r1 fixed in 29.9.2-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-86410	LOW2.45	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-106072	LOW2.41	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-92388	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-86414	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-92390	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-105481	LOW2.34	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-97032	LOW2.12	docker-cli 29.8.2-r1 fixed in 29.9.0-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-86411	LOW2.12	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.1% Theoretical Threat	Post-Exploit
CVE-2026-78663	LOW1.91	docker-cli 29.8.2-r1 fixed in 29.9.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-86409	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-86412	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-86413	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-107928	LOW1.73	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-106074	LOW1.73	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-92386	LOW1.55	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-107929	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-86415	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-87861	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-87862	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-87863	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-87864	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-87865	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-87866	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-92387	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-92389	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-92391	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-106070	LOW1.33	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-106071	LOW1.3	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-56857	LOW1.19	docker-cli 29.8.2-r1 fixed in 29.9.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-94266	LOW1.19	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-106073	LOW1.19	nodejs 24.18.1-r0 fixed in 24.22.1-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-94265	LOW1.12	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.3% Theoretical Threat	Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.