quay.io/argoprojlabs/argocd-image-updater:v1.2.1
Base OS: alpine 3.23.447 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/argoprojlabs/argocd-image-updater:v1.2.1
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/argoprojlabs/argocd-image-updater:v1.2.1
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/argoprojlabs/argocd-image-updater:v1.2.1 \ --owner verity-org
Before patching
Found 92 vulnerabilities in the original image. 47 fixed by Copa. 45 remaining after patching.
30 HIGH36 MEDIUM24 LOW2 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-33540HIGH
- Package
- github.com/distribution/distribution/v3
- Installed
- v3.0.0-20230722181636-7b502560cad4
- Fixed
- 3.1.0
- CVE-2026-35172HIGH
- Package
- github.com/distribution/distribution/v3
- Installed
- v3.0.0-20230722181636-7b502560cad4
- Fixed
- 3.1.0
- CVE-2026-44973HIGH
- Package
- github.com/go-git/go-billy/v5
- Installed
- v5.6.2
- Fixed
- 5.9.0
- CVE-2026-45022HIGH
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.19.0
- CVE-2026-39828HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39829HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39830HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39831HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39832HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39835HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-42508HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-46595HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-46597HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-25681HIGH
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.55.0
- CVE-2026-27136HIGH
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.55.0
- CVE-2026-33814HIGH
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.53.0
- CVE-2026-39821HIGH
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.55.0
- CVE-2026-50151HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.26.3
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-39822HIGH
- Package
- stdlib
- Installed
- v1.26.3
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.26.3
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-41888MEDIUM
- Package
- github.com/distribution/distribution/v3
- Installed
- v3.0.0-20230722181636-7b502560cad4
- Fixed
- 3.1.1
- CVE-2026-44740MEDIUM
- Package
- github.com/go-git/go-billy/v5
- Installed
- v5.6.2
- Fixed
- 5.9.0
- CVE-2026-25934MEDIUM
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.16.5
- CVE-2026-34165MEDIUM
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.17.1
- CVE-2026-41506MEDIUM
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.18.0
- CVE-2026-45571MEDIUM
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.19.1
- GHSA-w5pp-99ch-qj29MEDIUM
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.19.1
- CVE-2026-39827MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39833MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-39834MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-46598MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
- 0.52.0
- CVE-2026-25680MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.55.0
- CVE-2026-42502MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.55.0
- CVE-2026-42506MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.52.0
- Fixed
- 0.55.0
- CVE-2026-50162MEDIUM
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- GHSA-vh4v-2xq2-g5cgMEDIUM
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- CVE-2026-42505MEDIUM
- Package
- stdlib
- Installed
- v1.26.3
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.26.3
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-33762LOW
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.17.1
- CVE-2026-45570LOW
- Package
- github.com/go-git/go-git/v5
- Installed
- v5.14.0
- Fixed
- 5.19.1
- CVE-2026-48978LOW
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.42.0
- Fixed
- 0.44.0
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-33540 | github.com/distribution/distribution/v3 | v3.0.0-20230722181636-7b502560cad4 | 3.1.0 | HIGH |
| CVE-2026-35172 | github.com/distribution/distribution/v3 | v3.0.0-20230722181636-7b502560cad4 | 3.1.0 | HIGH |
| CVE-2026-44973 | github.com/go-git/go-billy/v5 | v5.6.2 | 5.9.0 | HIGH |
| CVE-2026-45022 | github.com/go-git/go-git/v5 | v5.14.0 | 5.19.0 | HIGH |
| CVE-2026-39828 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-39829 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-39830 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-39831 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-39832 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-39835 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-42508 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-46595 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-46597 | golang.org/x/crypto | v0.49.0 | 0.52.0 | HIGH |
| CVE-2026-25681 | golang.org/x/net | v0.52.0 | 0.55.0 | HIGH |
| CVE-2026-27136 | golang.org/x/net | v0.52.0 | 0.55.0 | HIGH |
| CVE-2026-33814 | golang.org/x/net | v0.52.0 | 0.53.0 | HIGH |
| CVE-2026-39821 | golang.org/x/net | v0.52.0 | 0.55.0 | HIGH |
| CVE-2026-50151 | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | HIGH |
| CVE-2026-27145 | stdlib | v1.26.3 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-39822 | stdlib | v1.26.3 | 1.25.12, 1.26.5, 1.27.0-rc.2 | HIGH |
| CVE-2026-42504 | stdlib | v1.26.3 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-41888 | github.com/distribution/distribution/v3 | v3.0.0-20230722181636-7b502560cad4 | 3.1.1 | MEDIUM |
| CVE-2026-44740 | github.com/go-git/go-billy/v5 | v5.6.2 | 5.9.0 | MEDIUM |
| CVE-2026-25934 | github.com/go-git/go-git/v5 | v5.14.0 | 5.16.5 | MEDIUM |
| CVE-2026-34165 | github.com/go-git/go-git/v5 | v5.14.0 | 5.17.1 | MEDIUM |
| CVE-2026-41506 | github.com/go-git/go-git/v5 | v5.14.0 | 5.18.0 | MEDIUM |
| CVE-2026-45571 | github.com/go-git/go-git/v5 | v5.14.0 | 5.19.1 | MEDIUM |
| GHSA-w5pp-99ch-qj29 | github.com/go-git/go-git/v5 | v5.14.0 | 5.19.1 | MEDIUM |
| CVE-2026-39827 | golang.org/x/crypto | v0.49.0 | 0.52.0 | MEDIUM |
| CVE-2026-39833 | golang.org/x/crypto | v0.49.0 | 0.52.0 | MEDIUM |
| CVE-2026-39834 | golang.org/x/crypto | v0.49.0 | 0.52.0 | MEDIUM |
| CVE-2026-46598 | golang.org/x/crypto | v0.49.0 | 0.52.0 | MEDIUM |
| CVE-2026-25680 | golang.org/x/net | v0.52.0 | 0.55.0 | MEDIUM |
| CVE-2026-42502 | golang.org/x/net | v0.52.0 | 0.55.0 | MEDIUM |
| CVE-2026-42506 | golang.org/x/net | v0.52.0 | 0.55.0 | MEDIUM |
| CVE-2026-50162 | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | MEDIUM |
| GHSA-vh4v-2xq2-g5cg | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | MEDIUM |
| CVE-2026-42505 | stdlib | v1.26.3 | 1.25.12, 1.26.5, 1.27.0-rc.2 | MEDIUM |
| CVE-2026-42507 | stdlib | v1.26.3 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-33762 | github.com/go-git/go-git/v5 | v5.14.0 | 5.17.1 | LOW |
| CVE-2026-45570 | github.com/go-git/go-git/v5 | v5.14.0 | 5.19.1 | LOW |
| CVE-2026-48978 | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | LOW |
| CVE-2026-39824 | golang.org/x/sys | v0.42.0 | 0.44.0 | UNKNOWN |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2026-50163HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.49.0
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-50163 | oras.land/oras-go/v2 | v2.6.0 | HIGH | |
| GO-2026-5932 | golang.org/x/crypto | v0.49.0 | UNKNOWN |
Original image reference
quay.io/argoprojlabs/argocd-image-updater:v1.2.1