Skip to main content
logoTetrate Patch ServiceVersion: alpha

Understanding CVE Scanning and Findings

Tetrate Patch Service scans every container image observed running in your clusters for known Common Vulnerabilities and Exposures (CVE) and reports each match as a finding in the CVEs view. What you see is the live exposure of your own fleet, not a generic advisory feed: every finding names an image one of your clusters runs right now and closes only on scan evidence. This page explains how scanning works, what the categories and statuses mean, and why the view is read-only.

How Scanning Works​

The agent in each cluster reports every container image actually running there, and Tetrate scans every distinct observed image for known CVEs each night. Deduplication is fleet-wide: an image running in ten clusters is scanned once, and the result applies to every cluster that runs it.

Two events trigger scans outside the nightly run:

  • Immediately after Tetrate publishes a release. A new release changes which findings are actionable and what they upgrade to, so the fleet is re-scanned right away rather than waiting for the next night.
  • The first time a new image is observed, most often just after an upgrade rolls out. The Patch Service scans that single image immediately, so its exposure appears without waiting for the nightly run.

Scans report only CRITICAL and HIGH severity vulnerabilities. Upgrading is the remediation path in the Patch Service, and a CVE with no fixed version cannot be closed by upgrading, so reporting it would add noise without adding an action.

Finding Categories​

Every finding carries a category that answers one question: who acts on it. The category comes from comparing the finding's image against the release catalog, the single source of truth for what counts as a Tetrate image: an image that appears in no release manifest is third party.

CategoryWhat it meansWho acts
actionableThe image is a Tetrate image and a newer release fixes the CVE. The finding carries the upgrade target, the release that resolves it.You, by upgrading the affected clusters. On the managed data plane, the upgrade arrives as a pull request for you to release.
pendingThe image is already on the latest release, so the fix has to arrive in Tetrate's next release. When that release ships, the finding re-categorizes to actionable automatically.Tetrate, by shipping the release.
third partyThe image is not distributed by Tetrate, for example a metrics exporter running alongside a Tetrate product.No one in the Patch Service. The finding is informational.

Severity, Status, and Lifecycle​

A finding carries a severity, CRITICAL or HIGH, and one of two statuses: open or resolved. Only a scan moves a finding between them. A finding opens the first time a scan reports the CVE on an image you run, and it resolves when a later scan of the same image no longer reports it. There is no manual transition and no dismiss action.

In the All findings tab the status filter defaults to Open; switch it to Resolved or All to include closed findings, which render dimmed and struck through. A finding disappears entirely once no cluster of yours runs the affected image, because the view shows your current exposure, not your history.

Each CVE ID links to its entry in the National Vulnerability Database (NVD), where you can read the full advisory.

How Findings Are Prioritized​

Three things on a finding tell you where it belongs in the queue:

  • Severity separates CRITICAL from HIGH, and nothing lower is reported at all.
  • Category says who acts: actionable is yours to fix now, pending is Tetrate's to ship, third party is informational.
  • First detected is the age of the problem. It is fixed for the finding's lifetime: re-reporting refreshes the details but never moves it, so an old finding is genuinely old rather than recently re-noticed.

The All findings tab opens in the order those imply: most severe first, and oldest first within a severity. The top of that list is where to start.

Scan Freshness​

Scan freshness is shown alongside the results themselves. A banner warns you when the newest scan is more than 48 hours old, and a distinct message appears when no scan has ever completed. An image that has never been scanned shows No scan data, never a green badge.

No scan data is not clean

An unscanned image has not been checked, which is not the same as having nothing to find. The Patch Service fails visibly by design: missing or stale scan data always shows as missing or stale, so a view without warnings is one backed by a recent scan, never one hiding an outage.

Why the View Is Read-Only​

The CVEs view has no dismiss or accept-risk button by design: Tetrate owns remediation, so findings close on evidence, not judgment. Tetrate ships the patched release, categorizes your findings against it, and, on the managed data plane, opens the upgrade pull request in your GitOps repository.

Your part is visibility and, on the managed data plane, approval. Watch the CVEs view for actionable findings, and release the upgrade pull request when it arrives. Once the new images are observed running, the old image's findings resolve at the next scan without anyone touching them.

Next Steps​