ghcr.io/loft-sh/vcluster:0.24.1
Base OS: alpine 3.21.3282 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/loft-sh/vcluster:0.24.1
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/loft-sh/vcluster:0.24.1
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/loft-sh/vcluster:0.24.1 \ --owner verity-org
Before patching
Found 343 vulnerabilities in the original image. 282 fixed by Copa. 61 remaining after patching.
11 CRITICAL129 HIGH162 MEDIUM35 LOW6 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-33186CRITICAL
- Package
- google.golang.org/grpc
- Installed
- v1.73.0-dev
- Fixed
- 1.79.3
- CVE-2026-33186CRITICAL
- Package
- google.golang.org/grpc
- Installed
- v1.73.0-dev
- Fixed
- 1.79.3
- CVE-2025-15558HIGH
- Package
- github.com/docker/cli
- Installed
- v27.5.0+incompatible
- Fixed
- 29.2.0
- CVE-2026-34040HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 29.3.1
- CVE-2026-39828HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39829HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39830HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39831HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39832HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39835HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-42508HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-46595HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-46597HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2025-15558HIGH
- Package
- github.com/docker/cli
- Installed
- v27.5.0+incompatible
- Fixed
- 29.2.0
- CVE-2026-34040HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 29.3.1
- CVE-2026-39828HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39829HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39830HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39831HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39832HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39835HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-42508HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-46595HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-46597HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-25681HIGH
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-27136HIGH
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-39821HIGH
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2025-15558HIGH
- Package
- github.com/docker/cli
- Installed
- v27.5.0+incompatible
- Fixed
- 29.2.0
- CVE-2026-34040HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 29.3.1
- CVE-2026-33997MEDIUM
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 29.3.1
- CVE-2026-39827MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39833MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39834MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-46598MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-33997MEDIUM
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 29.3.1
- CVE-2026-39827MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39833MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-39834MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-46598MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- 0.52.0
- CVE-2026-25680MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-42502MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-42506MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-33997MEDIUM
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 29.3.1
- CVE-2025-54410LOW
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 25.0.13, 28.0.0
- CVE-2025-54410LOW
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 25.0.13, 28.0.0
- CVE-2025-54410LOW
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- 25.0.13, 28.0.0
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-33186 | google.golang.org/grpc | v1.73.0-dev | 1.79.3 | CRITICAL |
| CVE-2026-33186 | google.golang.org/grpc | v1.73.0-dev | 1.79.3 | CRITICAL |
| CVE-2025-15558 | github.com/docker/cli | v27.5.0+incompatible | 29.2.0 | HIGH |
| CVE-2026-34040 | github.com/docker/docker | v27.5.0+incompatible | 29.3.1 | HIGH |
| CVE-2026-39828 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39829 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39830 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39831 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39832 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39835 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-42508 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-46595 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-46597 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2025-15558 | github.com/docker/cli | v27.5.0+incompatible | 29.2.0 | HIGH |
| CVE-2026-34040 | github.com/docker/docker | v27.5.0+incompatible | 29.3.1 | HIGH |
| CVE-2026-39828 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39829 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39830 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39831 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39832 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-39835 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-42508 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-46595 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-46597 | golang.org/x/crypto | v0.51.0 | 0.52.0 | HIGH |
| CVE-2026-25681 | golang.org/x/net | v0.54.0 | 0.55.0 | HIGH |
| CVE-2026-27136 | golang.org/x/net | v0.54.0 | 0.55.0 | HIGH |
| CVE-2026-39821 | golang.org/x/net | v0.54.0 | 0.55.0 | HIGH |
| CVE-2025-15558 | github.com/docker/cli | v27.5.0+incompatible | 29.2.0 | HIGH |
| CVE-2026-34040 | github.com/docker/docker | v27.5.0+incompatible | 29.3.1 | HIGH |
| CVE-2026-33997 | github.com/docker/docker | v27.5.0+incompatible | 29.3.1 | MEDIUM |
| CVE-2026-39827 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-39833 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-39834 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-46598 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-33997 | github.com/docker/docker | v27.5.0+incompatible | 29.3.1 | MEDIUM |
| CVE-2026-39827 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-39833 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-39834 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-46598 | golang.org/x/crypto | v0.51.0 | 0.52.0 | MEDIUM |
| CVE-2026-25680 | golang.org/x/net | v0.54.0 | 0.55.0 | MEDIUM |
| CVE-2026-42502 | golang.org/x/net | v0.54.0 | 0.55.0 | MEDIUM |
| CVE-2026-42506 | golang.org/x/net | v0.54.0 | 0.55.0 | MEDIUM |
| CVE-2026-33997 | github.com/docker/docker | v27.5.0+incompatible | 29.3.1 | MEDIUM |
| CVE-2025-54410 | github.com/docker/docker | v27.5.0+incompatible | 25.0.13, 28.0.0 | LOW |
| CVE-2025-54410 | github.com/docker/docker | v27.5.0+incompatible | 25.0.13, 28.0.0 | LOW |
| CVE-2025-54410 | github.com/docker/docker | v27.5.0+incompatible | 25.0.13, 28.0.0 | LOW |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2026-41567HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-42306HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-50163HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.1
- Fixed
- CVE-2026-41567HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-42306HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-50163HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.1
- Fixed
- CVE-2026-41567HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-42306HIGH
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-50163HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.1
- Fixed
- CVE-2026-41568MEDIUM
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-41568MEDIUM
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- CVE-2026-41568MEDIUM
- Package
- github.com/docker/docker
- Installed
- v27.5.0+incompatible
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.51.0
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.52.0
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-41567 | github.com/docker/docker | v27.5.0+incompatible | HIGH | |
| CVE-2026-42306 | github.com/docker/docker | v27.5.0+incompatible | HIGH | |
| CVE-2026-50163 | oras.land/oras-go/v2 | v2.6.1 | HIGH | |
| CVE-2026-41567 | github.com/docker/docker | v27.5.0+incompatible | HIGH | |
| CVE-2026-42306 | github.com/docker/docker | v27.5.0+incompatible | HIGH | |
| CVE-2026-50163 | oras.land/oras-go/v2 | v2.6.1 | HIGH | |
| CVE-2026-41567 | github.com/docker/docker | v27.5.0+incompatible | HIGH | |
| CVE-2026-42306 | github.com/docker/docker | v27.5.0+incompatible | HIGH | |
| CVE-2026-50163 | oras.land/oras-go/v2 | v2.6.1 | HIGH | |
| CVE-2026-41568 | github.com/docker/docker | v27.5.0+incompatible | MEDIUM | |
| CVE-2026-41568 | github.com/docker/docker | v27.5.0+incompatible | MEDIUM | |
| CVE-2026-41568 | github.com/docker/docker | v27.5.0+incompatible | MEDIUM | |
| GO-2026-5932 | golang.org/x/crypto | v0.51.0 | UNKNOWN | |
| GO-2026-5932 | golang.org/x/crypto | v0.51.0 | UNKNOWN | |
| GO-2026-5932 | golang.org/x/crypto | v0.52.0 | UNKNOWN |
Original image reference
ghcr.io/loft-sh/vcluster:0.24.1