registry.rancher.com/rancher/hardened-calico:v3.32.2-build20260909

image scan · 29 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

AFFECTED(16) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.35.8	/usr/bin/calico-node	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.35.8 binary /usr/bin/calico-node (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.35.8	/usr/bin/calico-node	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.35.8 binary /usr/bin/calico-node (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/calicoctl	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /calicoctl (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/opt/cni/bin/calico	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /opt/cni/bin/calico (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/opt/cni/bin/calico-ipam	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /opt/cni/bin/calico-ipam (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/opt/cni/bin/install	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /opt/cni/bin/install (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/usr/bin/calico-node	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /usr/bin/calico-node (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/usr/bin/check-status	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /usr/bin/check-status (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2	/usr/bin/kube-controllers	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2 binary /usr/bin/kube-controllers (stripped) packages github.com/projectcalico/calico (module) [ldflags-version]version not in build info (reported (devel)); read from the binary's own -ldflags stamp github.com/projectcalico/calico/kube-controllers/main.VERSION=v3.32.2
▸	UNKNOWN	CVE-2024-33522	github.com/projectcalico/calico	v3.32.2-build20260909	/usr/local/bin/flexvol/flexvoldriver	no fix	12.5%
advisory CVE-2024-33522 (also GO-2024-2801) from golang epss 12.5% 12.5% percentile (epss 0.00220) purl pkg:golang/github.com%2Fprojectcalico%2Fcalico@v3.32.2-build20260909 binary /usr/local/bin/flexvol/flexvoldriver (stripped) packages github.com/projectcalico/calico (module) [image-tag-version]version not in build info (reported (devel)); inferred from image tag "v3.32.2-build20260909" -- the image name contains the module name (calico)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/calicoctl	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /calicoctl (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/opt/cni/bin/calico	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /opt/cni/bin/calico (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/opt/cni/bin/calico-ipam	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /opt/cni/bin/calico-ipam (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/usr/bin/calico-node	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /usr/bin/calico-node (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/usr/bin/kube-controllers	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /usr/bin/kube-controllers (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6237	github.com/insomniacslk/dhcp	v0.0.0-20240829085014-a3a4c1f04475	/opt/cni/bin/dhcp	0.0.0-20260719225207-c76316d4aa82	—
advisory GO-2026-6237 from golang fixed in 0.0.0-20260719225207-c76316d4aa82 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Finsomniacslk%2Fdhcp@v0.0.0-20240829085014-a3a4c1f04475 binary /opt/cni/bin/dhcp (stripped) packages github.com/insomniacslk/dhcp/dhcpv4/nclient4 (package)

ALREADY VEXED(5) — a published statement answers these; vexscan's own verdict is unchanged

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Vendor	Reason
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.5	/calicoctl	3.6.14	33.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 binary /calicoctl (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/projectcalico/calico (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/projectcalico/calico` · published 2026-08-19T02:32:47Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.5	/opt/cni/bin/calico	3.6.14	33.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 binary /opt/cni/bin/calico (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/projectcalico/calico (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/projectcalico/calico` · published 2026-08-19T02:32:47Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.5	/opt/cni/bin/calico-ipam	3.6.14	33.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 binary /opt/cni/bin/calico-ipam (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/projectcalico/calico (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/projectcalico/calico` · published 2026-08-19T02:32:47Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.5	/usr/bin/calico-node	3.6.14	33.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 binary /usr/bin/calico-node (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/projectcalico/calico (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/projectcalico/calico` · published 2026-08-19T02:32:47Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.5	/usr/bin/kube-controllers	3.6.14	33.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 binary /usr/bin/kube-controllers (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/projectcalico/calico (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/projectcalico/calico` · published 2026-08-19T02:32:47Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5

RULED OUT(8) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.5	/opt/cni/bin/install	3.6.14	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 binary /opt/cni/bin/install (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/projectcalico/calico (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/projectcalico/calico` · published 2026-08-19T02:32:47Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.5.19; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.5
▸	UNKNOWN	GO-2026-5841	github.com/klauspost/compress	v1.18.0	/opt/cni/bin/calico	1.18.7	—	pclntab
advisory GO-2026-5841 from golang fixed in 1.18.7 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fklauspost%2Fcompress@v1.18.0 binary /opt/cni/bin/calico (stripped) packages github.com/klauspost/compress/s2 (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5841	github.com/klauspost/compress	v1.18.0	/opt/cni/bin/calico-ipam	1.18.7	—	pclntab
advisory GO-2026-5841 from golang fixed in 1.18.7 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fklauspost%2Fcompress@v1.18.0 binary /opt/cni/bin/calico-ipam (stripped) packages github.com/klauspost/compress/s2 (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/calicoctl	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /calicoctl (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/opt/cni/bin/calico	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /opt/cni/bin/calico (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/opt/cni/bin/calico-ipam	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /opt/cni/bin/calico-ipam (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/usr/bin/calico-node	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /usr/bin/calico-node (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/usr/bin/kube-controllers	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /usr/bin/kube-controllers (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	223	16	5	0	8	ok
`os`	96	0	0	0	0	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	6	ok

Triage: scored 16, 0 known exploited, 13 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.