registry.rancher.com/rancher/hardened-etcd:v3.7.1-k3s1-build20260910

image scan · 12 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

AFFECTED(1) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	UNKNOWN	CVE-2026-73499	go.etcd.io/etcd/server/v3	v3.7.1-k3s1+dirty	/usr/local/bin/etcd	3.7.1	29.9%
advisory CVE-2026-73499 (also GO-2026-6114) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 29.9% 29.9% percentile (epss 0.00365) purl pkg:golang/go.etcd.io%2Fetcd%2Fserver%2Fv3@v3.7.1-k3s1+dirty binary /usr/local/bin/etcd (stripped) packages go.etcd.io/etcd/server/v3/etcdserver/api/v3rpc (package)

UNDETERMINED(10) — not enough evidence to decide either way

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS
▸	MEDIUM	CVE-2020-15115	go.etcd.io/etcd/client/v3	(devel)	/usr/local/bin/etcd	3.4.10	69.8%
advisory CVE-2020-15115 (also GHSA-4993-m7g5-r9hh) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N fixed in 3.4.10 (also fixed in 3.3.23) epss 69.8% 69.8% percentile (epss 0.01342) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fv3@(devel) binary /usr/local/bin/etcd (stripped) packages go.etcd.io/etcd/client/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	MEDIUM	CVE-2020-15115	go.etcd.io/etcd/client/v3	(devel)	/usr/local/bin/etcdctl	3.4.10	69.8%
advisory CVE-2020-15115 (also GHSA-4993-m7g5-r9hh) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N fixed in 3.4.10 (also fixed in 3.3.23) epss 69.8% 69.8% percentile (epss 0.01342) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fv3@(devel) binary /usr/local/bin/etcdctl (stripped) packages go.etcd.io/etcd/client/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	(devel)	/usr/local/bin/etcd	3.7.1	33.2%
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@(devel) binary /usr/local/bin/etcd (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/pkg/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	(devel)	/usr/local/bin/etcdctl	3.7.1	33.2%
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@(devel) binary /usr/local/bin/etcdctl (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/pkg/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	LOW	GHSA-5x4g-q5rc-36jp	go.etcd.io/etcd/client/pkg/v3	(devel)	/usr/local/bin/etcd	3.4.10	—
advisory GHSA-5x4g-q5rc-36jp from golang severity LOW fixed in 3.4.10 (also fixed in 3.3.23) epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@(devel) binary /usr/local/bin/etcd (stripped) packages go.etcd.io/etcd/client/pkg/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/pkg/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	LOW	GHSA-5x4g-q5rc-36jp	go.etcd.io/etcd/client/pkg/v3	(devel)	/usr/local/bin/etcdctl	3.4.10	—
advisory GHSA-5x4g-q5rc-36jp from golang severity LOW fixed in 3.4.10 (also fixed in 3.3.23) epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@(devel) binary /usr/local/bin/etcdctl (stripped) packages go.etcd.io/etcd/client/pkg/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/pkg/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	LOW	GHSA-528j-9r78-wffx	go.etcd.io/etcd/client/v3	(devel)	/usr/local/bin/etcd	3.4.10	—
advisory GHSA-528j-9r78-wffx from golang severity LOW fixed in 3.4.10 (also fixed in 3.3.23) epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fv3@(devel) binary /usr/local/bin/etcd (stripped) packages go.etcd.io/etcd/client/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	LOW	GHSA-528j-9r78-wffx	go.etcd.io/etcd/client/v3	(devel)	/usr/local/bin/etcdctl	3.4.10	—
advisory GHSA-528j-9r78-wffx from golang severity LOW fixed in 3.4.10 (also fixed in 3.3.23) epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fv3@(devel) binary /usr/local/bin/etcdctl (stripped) packages go.etcd.io/etcd/client/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	LOW	GHSA-9gp7-6833-wv89	go.etcd.io/etcd/client/v3	(devel)	/usr/local/bin/etcd	3.4.10	—
advisory GHSA-9gp7-6833-wv89 from golang severity LOW fixed in 3.4.10 (also fixed in 3.3.23) epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fv3@(devel) binary /usr/local/bin/etcd (stripped) packages go.etcd.io/etcd/client/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown
▸	LOW	GHSA-9gp7-6833-wv89	go.etcd.io/etcd/client/v3	(devel)	/usr/local/bin/etcdctl	3.4.10	—
advisory GHSA-9gp7-6833-wv89 from golang severity LOW fixed in 3.4.10 (also fixed in 3.3.23) epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fv3@(devel) binary /usr/local/bin/etcdctl (stripped) packages go.etcd.io/etcd/client/v3 (module) reason version_not_range_matchable [uncomparable-version]build info reports (devel) for go.etcd.io/etcd/client/v3, which OSV cannot range-match; it answered with every advisory ever filed against the module, so whether this build is already past the fix is unknown

RULED OUT(1) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Method
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/usr/local/bin/etcd	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /usr/local/bin/etcd (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	74	1	0	10	1	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	0	ok

Triage: scored 5, 0 known exploited, 7 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.