quay.io/argoproj/argo-rollouts:v1.8.3
Base OS: debian 11.1080 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/argoproj/argo-rollouts:v1.8.3
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/argoproj/argo-rollouts:v1.8.3
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/argoproj/argo-rollouts:v1.8.3 \ --owner verity-org
Before patching
Found 96 vulnerabilities in the original image. 80 fixed by Copa. 16 remaining after patching.
2 CRITICAL38 HIGH44 MEDIUM5 LOW7 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-25681HIGH
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-27136HIGH
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-39821HIGH
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2024-10220HIGH
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.28.12, 1.29.7, 1.30.3
- CVE-2024-5321HIGH
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.27.16, 1.28.12, 1.29.7, 1.30.3
- CVE-2026-25680MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-42502MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2026-42506MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.54.0
- Fixed
- 0.55.0
- CVE-2024-9042MEDIUM
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.29.13, 1.30.9, 1.31.5, 1.32.1
- CVE-2025-0426MEDIUM
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.32.2, 1.31.6, 1.30.10, 1.29.14
- CVE-2025-13281MEDIUM
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.32.10, 1.33.6, 1.34.2
- CVE-2025-5187MEDIUM
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.31.12, 1.32.8, 1.33.4
- CVE-2024-3177LOW
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- 1.27.13, 1.29.4, 1.28.9
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-25681 | golang.org/x/net | v0.54.0 | 0.55.0 | HIGH |
| CVE-2026-27136 | golang.org/x/net | v0.54.0 | 0.55.0 | HIGH |
| CVE-2026-39821 | golang.org/x/net | v0.54.0 | 0.55.0 | HIGH |
| CVE-2024-10220 | k8s.io/kubernetes | v1.29.3 | 1.28.12, 1.29.7, 1.30.3 | HIGH |
| CVE-2024-5321 | k8s.io/kubernetes | v1.29.3 | 1.27.16, 1.28.12, 1.29.7, 1.30.3 | HIGH |
| CVE-2026-25680 | golang.org/x/net | v0.54.0 | 0.55.0 | MEDIUM |
| CVE-2026-42502 | golang.org/x/net | v0.54.0 | 0.55.0 | MEDIUM |
| CVE-2026-42506 | golang.org/x/net | v0.54.0 | 0.55.0 | MEDIUM |
| CVE-2024-9042 | k8s.io/kubernetes | v1.29.3 | 1.29.13, 1.30.9, 1.31.5, 1.32.1 | MEDIUM |
| CVE-2025-0426 | k8s.io/kubernetes | v1.29.3 | 1.32.2, 1.31.6, 1.30.10, 1.29.14 | MEDIUM |
| CVE-2025-13281 | k8s.io/kubernetes | v1.29.3 | 1.32.10, 1.33.6, 1.34.2 | MEDIUM |
| CVE-2025-5187 | k8s.io/kubernetes | v1.29.3 | 1.31.12, 1.32.8, 1.33.4 | MEDIUM |
| CVE-2024-3177 | k8s.io/kubernetes | v1.29.3 | 1.27.13, 1.29.4, 1.28.9 | LOW |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2023-46402HIGH
- Package
- github.com/whilp/git-urls
- Installed
- v0.0.0-20191001220047-6db9661140c0
- Fixed
- CVE-2025-1767MEDIUM
- Package
- k8s.io/kubernetes
- Installed
- v1.29.3
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.52.0
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2023-46402 | github.com/whilp/git-urls | v0.0.0-20191001220047-6db9661140c0 | HIGH | |
| CVE-2025-1767 | k8s.io/kubernetes | v1.29.3 | MEDIUM | |
| GO-2026-5932 | golang.org/x/crypto | v0.52.0 | UNKNOWN |
Original image reference
quay.io/argoproj/argo-rollouts:v1.8.3