registry.k8s.io/nfd/node-feature-discovery:v0.19.0

30 vulnerabilities fixed

Patched Image

ghcr.io/verity-org/kubernetes-sigs/node-feature-discovery:v0.19.0

Supply Chain

SignedSLSA L3SBOMRekor

Verify this artifact

Cosign signature

cosign verify \
  --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/verity-org/kubernetes-sigs/node-feature-discovery:v0.19.0

Build provenance

gh attestation verify \
  oci://ghcr.io/verity-org/kubernetes-sigs/node-feature-discovery:v0.19.0 \
  --owner verity-org

Before patching

Found 36 vulnerabilities in the original image. 30 fixed by Copa. 6 remaining after patching.

19 HIGH12 MEDIUM5 UNKNOWN

Awaiting upstream fix

No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.

CVE-2026-50163HIGH
Package
oras.land/oras-go/v2
Installed
v2.6.1
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.53.0
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.53.0
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.53.0
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.53.0
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.53.0
Fixed

ID	Package	Installed	Severity
CVE-2026-50163	oras.land/oras-go/v2	v2.6.1	HIGH
GO-2026-5932	golang.org/x/crypto	v0.53.0	UNKNOWN
GO-2026-5932	golang.org/x/crypto	v0.53.0	UNKNOWN
GO-2026-5932	golang.org/x/crypto	v0.53.0	UNKNOWN
GO-2026-5932	golang.org/x/crypto	v0.53.0	UNKNOWN
GO-2026-5932	golang.org/x/crypto	v0.53.0	UNKNOWN

Original image reference

registry.k8s.io/nfd/node-feature-discovery:v0.19.0