2026 Container Image CVE Blocklist: Build a CI/CD Gate That Fails Closed

01 · A blocklist is a release decision—not an exploit detector

Your pipeline can report zero critical findings and still promote an image that crosses a dangerous trust boundary. It can also fail every build on a rejected CVE or a Windows-only condition in a Linux deployment. Neither outcome is evidence-driven security.

The objective here is precise: stop promotion when a trusted scan reports a listed vulnerable component, or when the evidence is incomplete. This is a reviewed September 2026 baseline, not an automatically maintained threat feed or a claim that every listed package is remotely exploitable everywhere.

Threat model: an untrusted change introduces a vulnerable dependency; a compromised builder can forge reports; a controller or runtime turns limited input into wider authority. The reference evaluator assumes a trusted promotion job whose policy and tools cannot be rewritten by the application pull request. If the change being reviewed can disable its own gate, the gate is advisory.

The boundaries are image → container process, controller → Kubernetes API and runtime → host. Container UID 0, a usable token and host-root execution are different findings. Each transition needs evidence; no CVE identifier proves all three.

02 · The verified CVE ledger: 37 candidates, three decisions

Reviewed September 16, 2026 against public CNA records and maintainer references: 34 deny-on-match entries, two platform-review entries and one rejected exclusion. “Deny” is this reference policy's conservative release choice, not a severity rating or proof of active exploitation. A review match also stops promotion; it is not an automatic exception.

Listed patch versions are historical fix floors. Select a supported release containing all applicable fixes; branch backports and product editions change the right answer. No KEV membership, CVSS score or “exploited within hours” assertion is inferred from a vulnerability title.

Download reviewed ledger and policy · JSON · v1.0.0. Its example approval window expires September 23, 2026; renewal requires another review.

Why score-only and version-only rules both fail

The glibc maintainer describes a constrained scanf pattern; Ubuntu publishes distribution-specific fixed builds. The score cannot establish your application uses that pattern. An older-looking upstream version cannot establish that a distribution backport is missing. Record the conservative promotion decision separately from deployment-specific exploitability. glibc advisory; Ubuntu package status.

03 · Interactive decision map: what authorizes release?

04 · A small, testable gate—not a silently successful pipe

The downloadable evaluator supports Trivy container-image JSON schema 2 only. It rejects invalid structure, empty inventory, mismatched repository digest, expired policy and explicit suppressed findings. Grype uses another report shape; silently feeding it to a Trivy policy is not interoperability.

Download reference evaluator · JavaScript module · v1.0.0. Requires Node.js 22+. Review and place both downloaded files in a trusted policy workspace. Do not execute code fetched from a moving URL without verifying the approved revision.

Collect in a trusted Linux CI job

Prerequisites: approved Trivy executable, Node.js 22+, registry read access, downloaded evaluator/policy, and IMAGE set to a single-platform repository digest. Pin your scanner by verified release checksum or image digest. The temporary directory is job evidence, not a deployment output.

bashset -euo pipefail
: "${IMAGE:?Set IMAGE to registry/repository@sha256:...}"
work=$(mktemp -d)
printf '{}\n' > "$work/trivy.yaml"
: > "$work/empty.ignore"
trivy --version > "$work/scanner-version.txt"
trivy image \
  --config "$work/trivy.yaml" --cache-dir "$work/cache" \
  --image-src remote --platform linux/amd64 \
  --scanners vuln --pkg-types os,library --list-all-pkgs \
  --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
  --ignorefile "$work/empty.ignore" --ignore-unfixed=false \
  --show-suppressed --skip-db-update=false \
  --exit-code 0 --format json --output "$work/report.json" "$IMAGE"
node image-gate-v1.mjs "$work/report.json" image-cve-policy-v1.json "$IMAGE"
# Retain evidence with your CI provider's always-run artifact step.
# Promotion must require this job to succeed.

--exit-code 0 delegates finding decisions to the evaluator; scanner execution errors still fail the shell step. No pipeline hides the scanner's exit behind a later command. Consult the Trivy CLI reference for the pinned release.

What the sample does not implement

The digest check compares report fields; it does not authenticate their producer. A fresh cache requests current data but cannot prove an upstream mirror is fresh. Production adoption must enforce scanner/database trust and age, reject unexpected TRIVY_* overrides, normalize aliases, cover every architecture and bind evidence cryptographically. Run integration cases using a known affected artifact and a vendor-patched artifact. The reference unit fixtures are not a claim that your registry has been scanned.

“No listed match” is narrower than “vulnerability-free.” Keep your severity, exploitation, support-lifecycle and configuration rules. Vendor advisory matching and package provenance matter; see Trivy vulnerability matching.

05 · Carry the decision through promotion and admission

A report is not a signature; a signature is not a security approval. Establish the producer identity, artifact digest, platform, scanner version, database age, policy version and approval freshness. Only the trusted promotion service should attest that these checks passed. An application job must not authorize its own release by uploading arbitrary JSON.

These authorized read-only commands collect node and workload evidence separately. The runtime version string is a triage lead, not proof that a distribution fix is absent.

bashkubectl get nodes -o json | jq '.items[] | {
  node:.metadata.name, runtime:.status.nodeInfo.containerRuntimeVersion,
  osImage:.status.nodeInfo.osImage, kernel:.status.nodeInfo.kernelVersion
}'
kubectl get pods -A -o json | jq '.items[] | {
  namespace:.metadata.namespace, pod:.metadata.name, node:.spec.nodeName,
  images:[.spec.initContainers[]?.image,.spec.containers[]?.image,
          .spec.ephemeralContainers[]?.image],
  imageIDs:[.status.initContainerStatuses[]?.imageID,
            .status.containerStatuses[]?.imageID,
            .status.ephemeralContainerStatuses[]?.imageID]
}'

Keep exports restricted because they expose infrastructure structure. K8SEC Agent can correlate read-only workload, identity and exposure relationships; it does not patch nodes, execute in pods or collect Secret values.

06 · Detection, exceptions and recovery

Route a package match to its image owner, an incomplete scan to the evidence-pipeline owner, and an unapproved running digest to platform security. Monitor overridden checks, registry retagging, unexpected attestation issuers, stale database warnings and node-version drift. A previous green build cannot explain a different digest running today.

A generic runtime alert cannot detect a CVE number. Unexpected child processes, credential-file reads or controller egress support hypotheses; attribution needs context. If a controller wrote credentials into retained logs, patching the behavior does not revoke credentials already copied out. Preserve evidence, restrict log readers and rotate confirmed exposures through the incident process.

Exceptions are signed decisions, not ignored strings

Name the CVE, package, exact digest, environment, owner, rationale, control, independent approver and expiry. A VEX “not affected” assertion needs a trusted issuer and a defensible justification. A blanket package ignore is not equivalent. The reference evaluator implements no waiver feature; add one only with scope, signature and expiry tests.

Handle confirmed exploitation through incident response rather than ordinary release exceptions. Remove rejected entries through policy review, preserving why. Re-review the ledger weekly and on vendor correction. An old identifier such as CVE-2022-36804 remains relevant when affected software remains deployed.

07 · Operator cheat sheet and release checklist

This browser-only checklist resets on reload. It does not scan or transmit your environment.

08 · Final word: fail on evidence you can defend

Primary sources and verification trail

Each row links its public CNA record and primary reference. The implementation follows the Trivy report schema. Policy choices and enforcement guidance are K8SEC analysis, not vendor compliance requirements. JavaScript has fixture tests; shell examples receive syntax validation, not live production execution. The confidential source document is not distributed.