registry.rancher.com/rancher/hardened-flannel:v0.28.9-build20260909

image scan · 2 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

RULED OUT(2) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.13	/opt/bin/flanneld	3.6.14	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.13 binary /opt/bin/flanneld (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/flannel-io/flannel (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.13; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.13 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/flannel-io/flannel` · published 2026-09-01T02:15:25Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.13; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.13
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/opt/bin/flanneld	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /opt/bin/flanneld (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	76	0	0	0	2	ok
`os`	68	0	0	0	0	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	1	ok

Triage: scored 1, 0 known exploited, 1 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.