Vulnerability Reportthanosio/thanos:main-2026-06-15-7e675c9

thanosio/thanos:main-2026-06-15-7e675c9
digestsha256:a483f270966d6810b4d27eb0fba55b4aae108b7d9532abae7251ad882833ff49

Executive Summary

Last scanned:

Threat Score
25/100NEEDS ATTENTION
Reputation
RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The two exposed vulnerabilities (CVE-2026-29181, CVE-2026-33814) both have a severity of 6.38 and can cause denial of service attacks; there is no risk of data exposure or code execution. Note: CVE-2026-29181 only applies if OpenTelemetry tracing is enabled; disabling tracing or upgrading the library fully mitigates it. Disabling HTTP/2 or updating golang.org/x/net would fix CVE-2026-33814.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

36 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-29181MEDIUM6.38
go.opentelemetry.io/otel
v1.39.0
fixed in 1.41.0
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-33814MEDIUM6.38
golang.org/x/net
v0.49.0
fixed in 0.53.0
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-39883MEDIUM5.95
go.opentelemetry.io/otel/sdk
v1.39.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39827MEDIUM5.52
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39834MEDIUM5.52
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40179MEDIUM5.18
github.com/prometheus/prometheus
v0.309.1
fixed in 0.311.2-0.20260410083055-07c6232d159b
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-44903MEDIUM5.18
github.com/prometheus/prometheus
v0.309.1
fixed in 0.311.3
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42502MEDIUM5.18
golang.org/x/net
v0.49.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42154MEDIUM5.1
github.com/prometheus/prometheus
v0.309.1
fixed in 0.311.3, 0.305.2
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-39833MEDIUM4.67
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42506MEDIUM4.59
golang.org/x/net
v0.49.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-46598MEDIUM4.5
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42505MEDIUM4.5
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-39828LOW2.69
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-39832LOW2.66
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39821LOW2.51
golang.org/x/net
v0.49.0
fixed in 0.55.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39831LOW2.48
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-25681LOW2.48
golang.org/x/net
v0.49.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27136LOW2.48
golang.org/x/net
v0.49.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-39822LOW2.39
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-34986LOW2.29
github.com/go-jose/go-jose/v4
v4.1.3
fixed in 4.1.4
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-42151LOW2.29
github.com/prometheus/prometheus
v0.309.1
fixed in 0.311.3
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-39882LOW2.29
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
v1.39.0
fixed in 1.43.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-39829LOW2.29
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-39830LOW2.29
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39835LOW2.29
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-46597LOW2.29
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-42508LOW2.26
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-46595LOW2.17
golang.org/x/crypto
v0.47.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-25680LOW1.99
golang.org/x/net
v0.49.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-2303NONE0
go.mongodb.org/mongo-driver
v1.17.6
fixed in 1.17.7
0.2%
Theoretical Threat
Not Applicable
CVE-2026-24051NONE0
go.opentelemetry.io/otel/sdk
v1.39.0
fixed in 1.40.0
0.2%
Theoretical Threat
Not Applicable
GO-2026-5932NONE0
golang.org/x/crypto
v0.47.0
No fix yet
—
Not Applicable
CVE-2026-46600NONE0
golang.org/x/net
v0.49.0
fixed in 0.56.0
—
Not Applicable
CVE-2026-39824NONE0
golang.org/x/sys
v0.40.0
fixed in 0.44.0
0.1%
Theoretical Threat
Not Applicable
CVE-2026-56852NONE0
golang.org/x/text
v0.33.0
fixed in 0.39.0
—
Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.