external-secrets v2.12.0-tpio.1 trivy
Critical0
High0
Medium2
Low2
External Secrets Operator image page
publish scan at 2026-10-10T21:11:22Z. Digest: sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf.
Predicates verified from the signed registry attestations.
Predicate type: https://thepeoples.io/attestations/trivy-report/v1. SHA-256 of original predicate (compact JSON plus newline): 2308179fa696b60d016d193e8a925c5db3a244ed933d962ec85ba46c351180d4.
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/trivy-report/v1 oci.thepeoples.io/hardened/external-secrets@sha256:f29c67bcff4c6796df8991dcb8d0e1d69e6f0769dbadc688139260aff559d0cf | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum| GHSA-gcjh-h69q-9w9g | github.com/google/cel-go | v0.27.0 | 0.29.0 | MEDIUM | not supplied |
| CVE-2026-2303 | go.mongodb.org/mongo-driver | v1.17.6 | 1.17.7 | MEDIUM | not supplied |
| CVE-2026-81870 | go.opentelemetry.io/otel/exporters/otlp/otlptrace | v1.40.0 | 1.45.0 | LOW | not supplied |
| CVE-2026-81870 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc | v1.40.0 | 1.45.0 | LOW | not supplied |
| GO-2026-5932 | golang.org/x/crypto | v0.57.0 | not available | UNKNOWN | not supplied |
5 findings, including suppressed matches where reported.