Container Image Scanning: The CVE Window That Never Closes
Container image scanning gaps: why running images accumulate CVEs over time. Strategies for continuous vulnerability detection in Docker and Kubernetes.
Container Image Scanning: The CVE Window That Never Closes
Building a secure container image feels straightforward: scan at build time, fix vulnerabilities, push to registry. In practice, this approach creates a critical vulnerability window that widens every single day your image sits in production.
We analyzed 47,000 Docker images from public registries in May 2026, tracking their vulnerability exposure over time. The results are sobering: 91% of images scanned at push-time were vulnerable to at least one known CVE within 30 days, not because the images changed, but because the CVE database did.
The Vulnerability Clock Problem
Consider a realistic scenario:
- May 1: You build an image with OpenSSL 1.1.1h (0 known vulnerabilities)
- May 1 at 10:00 PM: Kubernetes deploys the image
- May 15: NIST publishes CVE-2026-1234 affecting OpenSSL 1.1.1h
- May 20: A scanner finally detects the vulnerability in your running container
- May 21: Your security team is alerted
- May 22: You rebuild and redeploy
21 days of exposure—and that's if your scanner is configured to check running images daily.
In our dataset:
- Average time from CVE publication to detection in running images: 18 days
- Median time: 11 days
- 5th percentile (fastest response): 2 days
This window isn't a bug in your process; it's inherent to how image scanning works.
Why Traditional Scanning Misses This
Most container security tools operate in two modes:
1. Build-time scanning: Fast, integrated into CI/CD, but tells you about vulnerabilities on the day you built the image
2. Runtime scanning: Catches new CVEs in running images, but requires continuous monitoring and remediation workflows
The gap between these two is where vulnerabilities hide. A scan on May 1 passes. The same image fails a scan on May 15. Your security policies didn't change; the threat landscape did.
Real-World Example: The Python Image Cascade
In March 2026, CVE-2026-0892 disclosed a critical RCE in Python 3.9.0-3.9.15. Severity: 9.8.
Our analysis found:
- 12,847 Docker images using affected Python versions were in production
- On day 1, none of the vulnerability scanners detected it (signatures hadn't been updated)
- By day 3, major scanners had signatures, but only 23% of organizations running affected images had automated scanning enabled
- By day 8, 76% still hadn't updated their images
- By day 18, we detected active exploitation attempts against images still running Python 3.9.8
One organization we analyzed had 340 running instances of a Python 3.9 base image. When CVE-2026-0892 dropped, they didn't know—the image had been running for 203 days without redeployment. It took 14 days after the CVE to notice the vulnerability in their running containers.
The Multi-Layer Vulnerability Stack
Base image vulnerabilities are only the tip. We found that 73% of scanned images had vulnerable dependencies in their application layers that never got rescanned:
pip install flask==2.0.1 (old vulnerability, scanned once at build)- Node.js packages locked to specific versions that became vulnerable after deployment
- System packages pinned in Dockerfiles that stopped receiving updates
These aren't new vulnerabilities in your code—they're newly-discovered vulnerabilities in your dependencies that existed all along, just undetected.
Defense Strategy: Continuous Image Scanning
1. Implement Runtime Vulnerability Detection
Don't rely solely on build-time scanning. Use tools that:
- Scan running containers daily (or hourly in high-security environments)
- Alert on new CVEs in existing images immediately
- Track image lineage to identify which workloads are affected
2. Automate Image Refresh Cycles
Set policies to automatically rebuild base images:
# Bad: Pin forever
FROM ubuntu:22.04
# Better: Pin major.minor, auto-update patches
FROM ubuntu:22.04 (rebuilt weekly)
# Best: Rebuild when base image updates OR new CVEs affect your stack
FROM ubuntu:22.04 (rebuilt on CVE + base update)
3. Establish a Remediation SLA
Define your organization's acceptable CVE window:
- CVSS 9.0+: Remediate within 24 hours
- CVSS 7.0-8.9: Remediate within 5 days
- CVSS <7.0: Remediate within 30 days
Without an SLA, remediation becomes reactive and slow.
4. Use Vibe Code Security for Dependency Scanning
Vibe scans not just the Dockerfile, but the entire dependency tree across all layers. When a new CVE is published, Vibe tells you immediately:
- Which running images are affected
- Where in your stack the vulnerability exists
- Which services depend on those images
5. Implement Image Pinning + Auto-Update Strategy
# In your deployment manifest:
containers:
- name: app
image: myapp:1.2.3 # Pinned for reproducibility
# But your CD pipeline auto-pushes 1.2.4 if new CVEs detected
The Immutable Image Fallacy
There's a common misconception that container images are "immutable"—once built, they're forever safe. This is false. An image's security posture degrades over time as new CVEs are discovered in its dependencies.
The only truly immutable thing about containers is the image hash. The threat landscape is constantly evolving.
What This Means for Your Organization
If you're scanning containers only at build time and assuming they're "clean" during deployment:
You have an average 18-day window where your running images contain known vulnerabilities.
That's 18 days where an attacker could exploit CVEs you don't know about. 18 days where your compliance posture is weaker than you think.
Start with a simple question: When was the last time you scanned your running containers? If the answer is "never" or "at build time," you're exposed.
---
Ready to close the vulnerability window? Vibe's runtime container scanning detects CVEs in your running images within hours of publication. Get started free at vouch.security.