registry.rancher.com/rancher/hardened-dns-node-cache:1.26.8-build20260909

image scan · 9 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

AFFECTED(3) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.34.2	/node-cache	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.34.2 binary /node-cache (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.34.2	/node-cache	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.34.2 binary /node-cache (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	UNKNOWN	GO-2026-5841	github.com/klauspost/compress	v1.18.4	/node-cache	1.18.7	—
advisory GO-2026-5841 from golang fixed in 1.18.7 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fklauspost%2Fcompress@v1.18.4 binary /node-cache (stripped) packages github.com/klauspost/compress/s2 (package)

RULED OUT(6) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.52.0	/node-cache	0.56.0	31.3%	pclntab
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 binary /node-cache (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/dns (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.52.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/dns` · published 2026-09-03T02:19:32Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.52.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0
▸	HIGH	CVE-2026-56854	golang.org/x/crypto	v0.52.0	/node-cache	0.55.0	25.4%	pclntab
advisory CVE-2026-56854 (also GO-2026-6303) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N fixed in 0.55.0 epss 25.4% 25.4% percentile (epss 0.00325) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 binary /node-cache (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/dns (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.52.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/dns` · published 2026-08-29T02:11:52Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.52.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.52.0	/node-cache	0.56.0	24.3%	pclntab
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 binary /node-cache (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/dns (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.52.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/dns` · published 2026-09-03T02:19:32Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.52.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0
▸	MEDIUM	CVE-2026-56864	golang.org/x/mod	v0.37.0	/node-cache	0.40.0	22.3%	pclntab
advisory CVE-2026-56864 (also GO-2026-6180) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N fixed in 0.40.0 epss 22.3% 22.3% percentile (epss 0.00298) purl pkg:golang/golang.org%2Fx%2Fmod@v0.37.0 binary /node-cache (stripped) packages golang.org/x/mod/sumdb (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/dns (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/mod@v0.37.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.37.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/dns` · published 2026-08-15T02:29:41Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/mod@v0.37.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.37.0
▸	HIGH	CVE-2026-56865	golang.org/x/mod	v0.37.0	/node-cache	0.40.0	1.3%	pclntab
advisory CVE-2026-56865 (also GO-2026-6179) from golang severity HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H fixed in 0.40.0 epss 1.3% 1.3% percentile (epss 0.00107) purl pkg:golang/golang.org%2Fx%2Fmod@v0.37.0 binary /node-cache (stripped) packages golang.org/x/mod/sumdb/tlog (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/dns (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/mod@v0.37.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.37.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/dns` · published 2026-08-15T02:29:41Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/mod@v0.37.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.37.0
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.52.0	/node-cache	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0 binary /node-cache (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	133	3	0	0	6	ok
`os`	66	0	0	0	0	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	5	ok

Triage: scored 7, 0 known exploited, 2 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.