Running container images have no unresolved CVEs

​

What this check verifies

​

Risk

• RCE, container escape, and node takeover affecting integrity/availability
• Data exfiltration and secret theft compromising confidentiality Adversaries can use public exploits to pivot across clusters and pipelines, tamper images, and disrupt services.

​

Recommendation

• Rebuild from updated bases; pin versions, avoid latest
• Sign images; enforce admission control to block high-severity CVEs
• Drop root, restrict capabilities, isolate networks
• Continuously scan in CI/CD and at runtime; retire vulnerable images

​

Remediation

kubectl set image deployment/<DEPLOYMENT_NAME> <CONTAINER_NAME>=<PATCHED_IMAGE:TAG> -n <NAMESPACE>

resource "kubernetes_deployment" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    selector {
      match_labels = { app = "<example_resource_name>" }
    }
    template {
      metadata { labels = { app = "<example_resource_name>" } }
      spec {
        container {
          name  = "<example_resource_name>"
          image = "<patched_image:tag>" # Critical: use a patched image version to remove known vulnerabilities
        }
      }
    }
  }
}

​

References

• https://learn.microsoft.com/en-us/azure/container-registry/scan-images-defender
• https://learn.microsoft.com/en-us/azure/container-registry/container-registry-check-health
• https://learn.microsoft.com/en-MY/azure/defender-for-cloud/defender-for-containers-vulnerability-assessment-azure

​

Where this check fires