← Scan another repo

github.com/kubernetes-monitoring/kubernetes-mixin

@ 1e6b0e57f973

Submitted 8/5/2026, 4:14:05 PM · Status: ok

Risk grade
F
99 / 100
Findings
80
0 critical4 high29 medium9 low38 info0 on CISA KEV0ATT&CK
Showing 80 of 80 findings

Findings

  • A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
    grypeCVE-2026-56852EPSS 0.4%
  • Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
    grypeCVE-2026-46600EPSS 0.3%
  • A norm.Iter can enter an infinite loop when handling input containing ...
    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
    trivyCVE-2026-56852
  • Root file system is not read-only
    An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.
    trivyscripts/lgtm.yaml:59
  • Apply security context to your containers
    Apply security context to your containers on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Apply security context to your pods and containers
    Apply security context to your pods and containers on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Containers should not run with allowPrivilegeEscalation
    Containers should not run with allowPrivilegeEscalation on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Containers should run as a high UID to avoid host conflict
    Containers should run as a high UID to avoid host conflict on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • CPU limits should be set
    CPU limits should be set on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • CPU requests should be set
    CPU requests should be set on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Ensure that Service Account Tokens are only mounted where necessary
    Ensure that Service Account Tokens are only mounted where necessary on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Ensure that the seccomp profile is set to docker/default or runtime/default
    Ensure that the seccomp profile is set to docker/default or runtime/default on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Image should use digest
    Image should use digest on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Image Tag should be fixed - not latest or blank
    Image Tag should be fixed - not latest or blank on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Liveness Probe Should be Configured
    Liveness Probe Should be Configured on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Memory limits should be set
    Memory limits should be set on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Memory requests should be set
    Memory requests should be set on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Minimize the admission of containers with capabilities assigned
    Minimize the admission of containers with capabilities assigned on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Minimize the admission of containers with the NET_RAW capability
    Minimize the admission of containers with the NET_RAW capability on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Minimize the admission of pods which lack an associated NetworkPolicy
    Minimize the admission of pods which lack an associated NetworkPolicy on Pod.default.lgtm.app-lgtm
    checkovscripts/lgtm.yaml:44
  • Minimize the admission of root containers
    Minimize the admission of root containers on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • The default namespace should not be used
    The default namespace should not be used on Service.default.lgtm
    checkovscripts/lgtm.yaml:19
  • The default namespace should not be used
    The default namespace should not be used on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Use read-only filesystem for containers where possible
    Use read-only filesystem for containers where possible on Deployment.default.lgtm
    checkovscripts/lgtm.yaml:44
  • Cross-site Scripting (XSS) in github.com/yuin/goldmark
    grypeCVE-2026-5160EPSS 0.3%
  • Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel
    grypeCVE-2026-33320EPSS 0.2%
  • Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal in github.com/tomwright/dasel
    grypeCVE-2026-46378EPSS 0.1%
  • Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string in github.com/tomwright/dasel
    grypeCVE-2026-46377EPSS 0.1%
  • Can elevate its own privileges
    A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.
    trivyscripts/lgtm.yaml:59
  • hostPath volumes mounted
    According to pod security standard 'HostPath Volumes', HostPath volumes must be forbidden.
    trivyscripts/lgtm.yaml:49
  • Image tag ":latest" used
    It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.
    trivyscripts/lgtm.yaml:59
  • Runs as root user
    Force the running image to run as a non-root user to ensure least privileges.
    trivyscripts/lgtm.yaml:59
  • Seccomp policies disabled
    A program inside the container can bypass Seccomp protection policies.
    trivyscripts/lgtm.yaml:43

This report is public.