registry.rancher.com/rancher/rke2-cloud-provider:v1.35.1-0.20260817230842-2a1e2e8cf41b-build20260910

image scan · 3 findings

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

AFFECTED(2) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS
▸	MEDIUM	CVE-2026-54250	github.com/k3s-io/k3s	v1.35.1-0.20260817230842-2a1e2e8cf41b	/usr/local/bin/rke2-cloud-provider	1.35.3	6.3%
advisory CVE-2026-54250 (also GHSA-jxr7-mqhw-9p98) from golang severity MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H fixed in 1.35.3 (also fixed in 1.34.6, 1.33.10) epss 6.3% 6.3% percentile (epss 0.00167) purl pkg:golang/github.com%2Fk3s-io%2Fk3s@v1.35.1-0.20260817230842-2a1e2e8cf41b binary /usr/local/bin/rke2-cloud-provider (stripped) packages github.com/k3s-io/k3s (module)
▸	UNKNOWN	GO-2026-6094	github.com/google/cel-go	v0.29.0	/usr/local/bin/rke2-cloud-provider	0.30.0	—
advisory GO-2026-6094 from golang fixed in 0.30.0 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/github.com%2Fgoogle%2Fcel-go@v0.29.0 binary /usr/local/bin/rke2-cloud-provider (stripped) packages github.com/google/cel-go/ext (package)

RULED OUT(1) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Method
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.56.0	/usr/local/bin/rke2-cloud-provider	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.56.0 binary /usr/local/bin/rke2-cloud-provider (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Undetermined	Ruled out	Status
`golang`	135	2	0	0	1	ok

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	0	ok

Triage: scored 1, 0 known exploited, 2 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.

1 match dropped: the advisory's own ranges excluded the version it was matched against (GO-2025-3646).