registry.rancher.com/rancher/hardened-k8s-metrics-server:v0.9.0-build20260909

image scan · 3 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

AFFECTED(1) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	Method
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/metrics-server	0.30.0
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /metrics-server (stripped) packages github.com/google/cel-go/ext (package)

RULED OUT(2) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.6.7	/metrics-server	3.6.14	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.6.14 (also fixed in 3.5.33, 3.7.1) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.7 binary /metrics-server (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/sigs.k8s.io/metrics-server (vulnerable_code_not_in_execute_path); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.7; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.7 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/sigs.k8s.io/metrics-server` · published 2026-08-19T02:42:37Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.7; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.6.7
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/metrics-server	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /metrics-server (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	98	1	0	0	2	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	1	ok

Triage: scored 1, 0 known exploited, 2 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.