🚨 [Trivy] 5 vulnerabilities detected on backplane-2.11

[github-actions]

🚨 Security Alert: Vulnerabilities Detected (Trivy)

Overview

The Trivy security scanner has detected vulnerabilities on branch backplane-2.11.

Field	Value
Scanner	Trivy
Branch	backplane-2.11
🔴 CRITICAL	1
🟠 HIGH	2
🟡 MEDIUM	1
🟢 LOW	1
TOTAL	5
Workflow Run	23762417315
Date	2026-03-30 19:08:59 UTC

📋 Scan Results

🔒 SARIF Results: View in Security Tab

Trivy Findings

Report Summary

┌───────────────────┬───────┬─────────────────┬─────────┐
│      Target       │ Type  │ Vulnerabilities │ Secrets │
├───────────────────┼───────┼─────────────────┼─────────┤
│ go.mod            │ gomod │        5        │    -    │
├───────────────────┼───────┼─────────────────┼─────────┤
│ hack/tools/go.mod │ gomod │        0        │    -    │
└───────────────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


go.mod (gomod)
==============
Total: 5 (LOW: 1, MEDIUM: 1, HIGH: 2, CRITICAL: 1)

┌──────────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│           Library            │ Vulnerability  │ Severity │ Status │  Installed Version   │ Fixed Version │                            Title                             │
├──────────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/cloudflare/circl  │ CVE-2026-1229  │ LOW      │ fixed  │ v1.6.1               │ 1.6.3         │ CIRCL has an incorrect calculation in secp384r1 CombinedMult │
│                              │                │          │        │                      │               │ https://avd.aquasec.com/nvd/cve-2026-1229                    │
├──────────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/docker/docker     │ CVE-2026-34040 │ HIGH     │        │ v28.3.3+incompatible │ 29.3.1        │ Moby has AuthZ plugin bypass when provided oversized request │
│                              │                │          │        │                      │               │ bodies                                                       │
│                              │                │          │        │                      │               │ https://avd.aquasec.com/nvd/cve-2026-34040                   │
│                              ├────────────────┼──────────┤        │                      │               ├──────────────────────────────────────────────────────────────┤
│                              │ CVE-2026-33997 │ MEDIUM   │        │                      │               │ Moby has an Off-by-one error in its plugin privilege         │
│                              │                │          │        │                      │               │ validation                                                   │
│                              │                │          │        │                      │               │ https://avd.aquasec.com/nvd/cve-2026-33997                   │
├──────────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH     │        │ v1.39.0              │ 1.40.0        │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution  │
│                              │                │          │        │                      │               │ via PATH Hijacking                                           │
│                              │                │          │        │                      │               │ https://avd.aquasec.com/nvd/cve-2026-24051                   │
├──────────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc       │ CVE-2026-33186 │ CRITICAL │        │ v1.77.0              │ 1.79.3        │ golang: google.golang.org/grpc/grpc-go:                      │
│                              │                │          │        │                      │               │ google.golang.org/grpc/authz: gRPC-Go: Authorization bypass  │
│                              │                │          │        │                      │               │ due to improper HTTP/2 path validation...                    │
│                              │                │          │        │                      │               │ https://avd.aquasec.com/nvd/cve-2026-33186                   │
└──────────────────────────────┴────────────────┴──────────┴────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

🔧 Remediation

1. Prioritize by severity: CRITICAL → HIGH → MEDIUM → LOW
2. Update vulnerable dependencies: go get -u <package>@<safe-version> && go mod tidy
3. Test changes: make test
4. Verify locally: docker run --rm -v $(pwd):/scan aquasec/trivy fs /scan

---

🤖 This issue was automatically created by the security scan workflow

[RadekCap]

Solved in ARO-25822