Vulnerability Scanning
Kupe scans every workload for CVEs, misconfigurations, exposed secrets, and RBAC issues, and puts the results in the console under Security. This page covers what gets scanned, how to read the reports, and what to do about a finding.
What gets scanned
Section titled “What gets scanned”| Category | What it checks | Example finding |
|---|---|---|
| Vulnerabilities | Known CVEs in your container images | CVE-2024-21626 in runc (CRITICAL, CVSS 8.6) |
| Config Audit | Kubernetes manifest misconfigurations | Container running as root, missing resource limits |
| RBAC | Overly permissive role bindings | ClusterRole with wildcard verb access |
| Exposed Secrets | Hardcoded credentials in images | AWS access key found in /app/config.yaml |
| SBOM | Software Bill of Materials per image | Full component inventory with licences |
Scans run automatically when you deploy or update a workload. An unchanged image is re-scanned roughly every 24 hours (the report’s time-to-live); compliance reports regenerate every 6 hours.
Viewing your security reports
Section titled “Viewing your security reports”Open Security in the console sidebar. It has two sections:
Vulnerabilities
Section titled “Vulnerabilities”Three views of CVE data across all your workloads:
- CVE: Every unique vulnerability found, sorted by severity score. Shows which images and workloads are affected, whether a fix is available, and links to the CVE database.
- Resources: Your workloads listed with vulnerability counts broken down by severity (critical, high, medium, low). Click any workload to see its full scan report.
- Images: Your container images with aggregated vulnerability counts. Useful for identifying which base images need updating.
Compliance
Section titled “Compliance”Security posture checks across your cluster resources:
- Resources: Configuration audit results for your Kubernetes manifests (e.g., missing security contexts, privileged containers), filtered to show only resources with findings.
- RBAC: Permission analysis showing overly broad role bindings, filtered to show only role bindings with findings.
- Secrets: Exposed credentials detected in your container images, filtered to show only findings with actual issues.
How it works
Section titled “How it works”When you deploy a workload to your managed cluster:
- The platform detects the new or updated pods
- Container images are scanned for known vulnerabilities (CVEs)
- Kubernetes manifests are checked against the platform’s configuration audit policies
- Results are stored and immediately visible in the console
Scans are continuous: changed workloads are re-scanned immediately, and unchanged images are re-scanned roughly every 24 hours, so a newly published CVE affecting one of your images surfaces at the next rescan (within ~24 hours).
What you should do
Section titled “What you should do”Review critical and high severity findings regularly. The vulnerability table is sorted by CVSS score by default, so the most impactful issues appear first.
For each finding:
| Severity | Action |
|---|---|
| Critical (CVSS 9.0+) | Update the affected image as soon as possible |
| High (CVSS 7.0-8.9) | Plan to update in your next release cycle |
Only CRITICAL and HIGH findings are surfaced in the console. MEDIUM and LOW severities are filtered out, so there are no lower-severity findings to triage.
If a vulnerability shows “Fixed: Yes”, check the “Fix in version” column and update your dependency or base image to that version.
Scan configuration
Section titled “Scan configuration”The platform applies these defaults to keep scan results actionable:
- Severity filter: Only CRITICAL and HIGH findings are surfaced (
severity="CRITICAL,HIGH"); MEDIUM and LOW are not shown - Unfixed CVEs: Skipped. If no fix exists yet, the finding is suppressed to reduce noise
- Scan frequency: Immediately on every workload change; unchanged images are re-scanned roughly every 24 hours. (The 6-hour cron regenerates compliance reports, not CVE rescans.)
You cannot disable scanning for your cluster. Security scanning is a platform-enforced policy.
Report lifecycle
Section titled “Report lifecycle”Reports are tied to your workloads:
- Deploy a new workload → scan runs automatically, reports appear within minutes
- Update a workload → new scan runs, old reports are replaced
- Delete a workload → reports are automatically cleaned up
You never need to manually manage scan reports.
Related pages
Section titled “Related pages”- Cluster Policies: admission-time policy enforcement
- Container Security: security context requirements
- Network Isolation: egress restrictions