Vulnerability Reportthanosio/thanos:main-2026-06-17-421734b

thanosio/thanos:main-2026-06-17-421734b

digestsha256:1ea77b1e0407410d4bede6f501c2ccb014465b8a6faf11e73d6300b779b3cef6

Executive Summary

Last scanned: Jul 31, 2026

Threat ScoreSAFE• Popular community image with 76M+ pulls and pinned by digest for immutability.• Threat score of 0 falls in the SAFE band, indicating no significant risk.• Exposed vulnerabilities have a low maximum severity of 4.14, with no findings in the top exposed surface list.• Post-exploit findings are minimal (max severity 2.39) and not notable.• No CVE IDs were listed in the provided inputs, so no specific vulnerability citations apply.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (76M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. While the scan identified a small number of vulnerabilities (6 exposed, 4 post-exploit), the maximum severity is low (4.14 exposed, 2.39 post-exploit) and there are no notable findings that indicate practical exploitation in this context. The image is from a popular community source and is pinned by digest, adding supply chain assurance.

Vulnerabilities

Vulnerability Log

10 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-40179	MEDIUM4.14	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.2-0.20260410083055-07c6232d159b	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-42505	LOW2.7	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-39822	LOW2.39	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.2% Theoretical Threat	Post-Exploit
CVE-2026-42151	LOW2.29	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.3	0.4% Theoretical Threat	Post-Exploit
CVE-2026-42154	LOW2.29	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.3, 0.305.2	0.8% Theoretical Threat	Post-Exploit
CVE-2026-44903	LOW1.87	github.com/prometheus/prometheus v0.309.1 fixed in 0.311.3	0.2% Theoretical Threat	Post-Exploit
CVE-2026-2303	NONE0	go.mongodb.org/mongo-driver v1.17.6 fixed in 1.17.7	0.2% Theoretical Threat	Not Applicable
GO-2026-5932	NONE0	golang.org/x/crypto v0.53.0 No fix yet	—	Not Applicable
CVE-2026-56852	NONE0	golang.org/x/text v0.38.0 fixed in 0.39.0	0.4% Theoretical Threat	Not Applicable
GHSA-hrxh-6v49-42gf	NONE0	google.golang.org/grpc v1.81.1 fixed in 1.82.1	—	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.