Skip to content
QuenchWorks

VEXemissary

emissary

4 statements, issued .Each one is a scanner finding that is not exploitable in this image, and why.

ImageOpenVEX JSON

@id https://quench-works.com/vex/emissary/2026-10-05

  1. CVE-2024-9042

    not affected · vulnerable code not present
    • kubernetes v1.30.3

    emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is the kubelet's node log query handler (pkg/kubelet) on Windows nodes.

  2. CVE-2025-0426

    not affected · vulnerable code not present
    • kubernetes v1.30.3

    emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is the kubelet's checkpoint API (pkg/kubelet).

  3. CVE-2025-13281

    not affected · vulnerable code not present
    • kubernetes v1.30.3

    emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is kube-controller-manager's Portworx volume plugin (pkg/volume/portworx).

  4. CVE-2025-5187

    not affected · vulnerable code not present
    • kubernetes v1.30.3

    emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is kube-apiserver's NodeRestriction admission plugin (plugin/pkg/admission/noderestriction).