docker / docker/scout-cli

Docker Scout health grade shows “A” despite outstanding vulnerabilities

Open
#214 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
454
Forks
134
PR merge metrics
No merged PRs in 30d

Description

Image

Environment: Docker Hub / Docker Scout UI for image dellhpcomniaaisolution/ubuntu-ldms:1.0 (linux/amd64, based on ubuntu:24.04).

Issue: The Health badge at the top of the image view shows grade A, even though the vulnerability panel lists 968 total vulnerabilities (0 Critical, 3 High, 860 Medium, 44 Low) and highlights multiple fixable CVEs (e.g., CVE-2025-38666, CVE-2025-24049, CVE-2025-68973).

Expectation: Health grade should degrade from “A” when dozens/hundreds of Medium/Low issues exist, especially when Docker Scout marks them fixable.

Impact: Health grade misleads users into thinking the image is compliant; policy checks or automated gates that rely on the badge will incorrectly pass.

Please investigate how health scoring is calculated; it appears to ignore medium/low issues entirely or is not updated after new CVEs are detected.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the result in the Docker Scout UI for dellhpcomniaaisolution/ubuntu-ldms:1.0 on linux/amd64, comparing the Health badge with the vulnerability panel and listed fixable CVEs. Trace how the health score is calculated and refreshed after vulnerability detection. Done means the grade and policy-related result account for the relevant outstanding vulnerabilities instead of showing A misleadingly.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.