registry.rancher.com/rancher/hardened-kubernetes:v1.37.0-rke2r1-build20260909

image scan · 37 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

AFFECTED(17) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-apiserver	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-apiserver (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-controller-manager	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-controller-manager (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-proxy	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-proxy (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-scheduler	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-scheduler (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kubectl	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kubectl (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kubelet	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kubelet (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-apiserver	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-apiserver (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-controller-manager	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-controller-manager (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-proxy	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-proxy (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kube-scheduler	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kube-scheduler (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kubectl	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kubectl (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.37.0+dirty	/usr/local/bin/kubelet	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.37.0+dirty binary /usr/local/bin/kubelet (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.2	/usr/local/bin/kube-apiserver	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.2 binary /usr/local/bin/kube-apiserver (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.2	/usr/local/bin/kube-controller-manager	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.2 binary /usr/local/bin/kube-controller-manager (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.2	/usr/local/bin/kube-proxy	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.2 binary /usr/local/bin/kube-proxy (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.2	/usr/local/bin/kube-scheduler	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.2 binary /usr/local/bin/kube-scheduler (stripped) packages github.com/google/cel-go/ext (package)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.2	/usr/local/bin/kubelet	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.2 binary /usr/local/bin/kubelet (stripped) packages github.com/google/cel-go/ext (package)

ALREADY VEXED(1) — a published statement answers these; vexscan's own verdict is unchanged

Severity Advisory Package Version Location Fixed in EPSS Vendor Reason

▸ UNKNOWN CVE-2026-73500 go.etcd.io/etcd/client/pkg/v3 v3.7.0 /usr/local/bin/kube-apiserver 3.7.1 33.2% not_affected vulnerable_code_not_present

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Vendor	Reason
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.7.0	/usr/local/bin/kube-apiserver	3.7.1	33.2%	not_affected	vulnerable_code_not_present
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 binary /usr/local/bin/kube-apiserver (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-08-19T02:33:55Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0

advisory: CVE-2026-73500 (also GO-2026-6107)
from: golang
fixed in: 3.7.1 (also fixed in 3.5.33, 3.6.14)
epss: 33.2% 33.2% percentile (epss 0.00396)
purl: pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0
binary: /usr/local/bin/kube-apiserver (stripped)
packages: go.etcd.io/etcd/client/pkg/v3/transport (package)

[vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0

Rancher Security team says not_affected (vulnerable_code_not_present)

Govulncheck determined that the vulnerable code isn't called

product pkg:golang/k8s.io/kubernetes · published 2026-08-19T02:33:55Z · from https://github.com/rancher/vexhub

matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0

RULED OUT(19) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.7.0	/usr/local/bin/kube-controller-manager	3.7.1	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 binary /usr/local/bin/kube-controller-manager (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-08-19T02:33:55Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.7.0	/usr/local/bin/kube-proxy	3.7.1	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 binary /usr/local/bin/kube-proxy (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-08-19T02:33:55Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.7.0	/usr/local/bin/kube-scheduler	3.7.1	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 binary /usr/local/bin/kube-scheduler (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-08-19T02:33:55Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0
▸	UNKNOWN	CVE-2026-73500	go.etcd.io/etcd/client/pkg/v3	v3.7.0	/usr/local/bin/kubelet	3.7.1	33.2%	pclntab
advisory CVE-2026-73500 (also GO-2026-6107) from golang fixed in 3.7.1 (also fixed in 3.5.33, 3.6.14) epss 33.2% 33.2% percentile (epss 0.00396) purl pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 binary /usr/local/bin/kubelet (stripped) packages go.etcd.io/etcd/client/pkg/v3/transport (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-08-19T02:33:55Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5; component is pkg:golang/go.etcd.io%2Fetcd%2Fclient%2Fpkg%2Fv3@v3.7.0
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-apiserver	0.56.0	31.3%	pclntab
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-apiserver (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-controller-manager	0.56.0	31.3%	pclntab
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-controller-manager (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-proxy	0.56.0	31.3%	pclntab
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-proxy (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-scheduler	0.56.0	31.3%	pclntab
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-scheduler (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.55.0	/usr/local/bin/kubelet	0.56.0	31.3%	pclntab
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kubelet (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-apiserver	0.56.0	24.3%	pclntab
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-apiserver (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-controller-manager	0.56.0	24.3%	pclntab
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-controller-manager (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-proxy	0.56.0	24.3%	pclntab
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-proxy (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-scheduler	0.56.0	24.3%	pclntab
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-scheduler (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.55.0	/usr/local/bin/kubelet	0.56.0	24.3%	pclntab
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kubelet (stripped) packages golang.org/x/crypto/ssh (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/k8s.io/kubernetes (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/k8s.io/kubernetes` · published 2026-09-03T02:20:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.28.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-apiserver	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-apiserver (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-controller-manager	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-controller-manager (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-proxy	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-proxy (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.55.0	/usr/local/bin/kube-scheduler	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kube-scheduler (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.55.0	/usr/local/bin/kubelet	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0 binary /usr/local/bin/kubelet (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	175	17	1	0	19	ok
`os`	8	0	0	0	0	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	15	ok

Triage: scored 27, 0 known exploited, 10 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.