Vulnerability Reportthanosio/thanos:main-2026-06-17-421734b

thanosio/thanos:main-2026-06-17-421734b

digestsha256:1ea77b1e0407410d4bede6f501c2ccb014465b8a6faf11e73d6300b779b3cef6

Executive Summary

Last scanned: Jul 31, 2026

Threat ScoreSAFE• Popular community image with 76M+ pulls and pinned by digest for immutability.• Threat score of 0 falls in the SAFE band, indicating no significant risk.• Exposed vulnerabilities have a low maximum severity of 4.14, with no findings in the top exposed surface list.• Post-exploit findings are minimal (max severity 2.39) and not notable.• No CVE IDs were listed in the provided inputs, so no specific vulnerability citations apply.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (76M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. While the scan identified a small number of vulnerabilities (6 exposed, 4 post-exploit), the maximum severity is low (4.14 exposed, 2.39 post-exploit) and there are no notable findings that indicate practical exploitation in this context. The image is from a popular community source and is pinned by digest, adding supply chain assurance.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

10 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-40179	MEDIUM4.14	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.2-0.20260410083055-07c6232d159b	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-42505	LOW2.7	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-39822	LOW2.39	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.2% Theoretical Threat	Post-Exploit
CVE-2026-42151	LOW2.29	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.3	0.4% Theoretical Threat	Post-Exploit
CVE-2026-42154	LOW2.29	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.3, 0.305.2	0.8% Theoretical Threat	Post-Exploit
CVE-2026-44903	LOW1.87	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.3	0.2% Theoretical Threat	Post-Exploit
CVE-2026-2303	NONE0	go.mongodb.org/mongo-driver v1.17.6 fixed in 1.17.7	0.2% Theoretical Threat	Not Applicable
GO-2026-5932	NONE0	golang.org/x/crypto v0.53.0 No fix yet	—	Not Applicable
CVE-2026-56852	NONE0	golang.org/x/text v0.38.0 fixed in 0.39.0	0.4% Theoretical Threat	Not Applicable
GHSA-hrxh-6v49-42gf	NONE0	google.golang.org/grpc v1.81.1 fixed in 1.82.1	—	Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.