[security] Trivy Daily 持续阻断：kbcli 3 CRITICAL/29 HIGH，KubeBlocks 三镜像各 4 HIGH

[khalildai]

现象

Trivy Scan Daily 已连续多次失败；最近 10 个可见日常样本全部为 failure。最新自然样本：

• run: https://github.com/apecloud/apecloud-cd/actions/runs/30055750538
• workflow head: 3d312dbe2b2b2aba82c89a32364e819d78b7da6d
• scanner/DB 下载成功，红项来自真实 HIGH/CRITICAL 漏洞，不是 runner、网络或 registry 故障。

最新计数

• kbcli:v1.0.2: 32（HIGH 29 / CRITICAL 3）
• docker.io/apecloud/kubeblocks:latest: HIGH 4 / CRITICAL 0
• docker.io/apecloud/kubeblocks-tools:latest: HIGH 4 / CRITICAL 0
• docker.io/apecloud/kubeblocks-dataprotection:latest: HIGH 4 / CRITICAL 0
• docker.io/apecloud/kubeblocks-charts:latest: 0

日志中可直接见到的可修复项包括：

• github.com/jackc/pgx/v5 CVE-2026-33815（CRITICAL），installed v5.6.0，fixed 5.9.0
• google.golang.org/grpc CVE-2026-33186（CRITICAL），installed v1.74.2，fixed 1.79.3
• github.com/containerd/containerd CVE-2026-46680（HIGH），installed v1.7.29，fixed 1.7.32
• github.com/moby/spdystream CVE-2026-35469（HIGH），installed v0.5.0，fixed 0.5.1
• 三个 KubeBlocks 镜像共同包含 google.golang.org/grpc GHSA-hrxh-6v49-42gf（HIGH），installed v1.79.3，fixed 1.82.1，以及 Go runtime CVE-2026-39822 的修复版本要求。

建议收口

1. 明确 kbcli 与 KubeBlocks 镜像各自依赖升级 owner；不要用 .trivyignore 静默吞掉已有 fixed version 的漏洞。
2. 先升级可直接修复的 CRITICAL，再处理共享 grpc/Go runtime/base-image 项。
3. 产出新 tag/image 后，以一条 fresh scheduled/manual Trivy 全矩阵终态为验收；不 rerun 当前旧产物来掩盖结果。
4. 如某项被判定不可利用，提交逐 CVE 的 VEX/风险说明、适用范围与到期时间，而不是永久 ignore。

本单只记录与路由；未修改依赖、镜像、secret 或发布环境。

[khalildai]

2026-07-27 09:45 SGT patrol adds fresh scheduled evidence and broadens the affected scheduled surfaces; this remains real vulnerability debt, not runner/network/registry instability.

• Daily 30227202662: kbcli:v1.0.2 still 32 = HIGH 29 / CRITICAL 3; kubeblocks, kubeblocks-tools, and kubeblocks-dataprotection remain 4 HIGH each, while kubeblocks-charts is clean. Representative fixed-version findings remain pgx v5.6.0→5.9.0, grpc v1.74.2→1.79.3/1.82.1, containerd v1.7.29→1.7.32.
• Weekly 30227366032: all 24/24 image matrices failed on HIGH/CRITICAL findings, including multiple grpc/Go stdlib/base-image vulnerabilities.
• Cloud 30230102872: 13/15 image matrices failed; only loki and victoria-metrics were clean in this run.

Scanner/DB startup completed and the jobs failed on reported vulnerabilities. This expands the operational blast radius beyond the two Daily jobs already in the issue body; rerunning unchanged images would reproduce the same result. Please keep the existing upgrade/VEX acceptance: upgrade fixed versions or provide per-CVE scoped VEX with expiry, then verify with fresh scheduled/manual matrices. No ignore, rerun, secret, image, or workflow mutation was performed by patrol.

[khalildai]

2026-07-28 09:48 SGT patrol adds fresh Daily evidence from run https://github.com/apecloud/apecloud-cd/actions/runs/30316890340 (exact workflow head e60c2253d9111e047e58faa4c0e4456c098ead70).

• kbcli:v1.0.2 remains 32 findings = 3 CRITICAL / 29 HIGH.
• apecloud/kubeblocks:latest, kubeblocks-tools:latest, and kubeblocks-dataprotection:latest now each report 3 HIGH / 0 CRITICAL (down from 4 HIGH each in the previous recorded Daily); kubeblocks-charts:latest remains clean.
• Scanner installation and image scans completed; the jobs intentionally failed in view trivy scan report on the vulnerability totals. Self-hosted runners were not involved.

This is still real image/dependency vulnerability debt, not runner/network/registry instability. No unchanged-image rerun, ignore/VEX, secret, image, or workflow mutation was performed by patrol.

[khalildai]

2026-07-29 09:51 SGT patrol adds fresh Trivy Daily evidence from run 30410672118 (exact workflow head e60c2253d9111e047e58faa4c0e4456c098ead70).

• kbcli:v1.0.2 now reports 33 findings = 3 CRITICAL / 30 HIGH (previous recorded sample: 3 CRITICAL / 29 HIGH).
• apecloud/kubeblocks:latest, kubeblocks-tools:latest, and kubeblocks-dataprotection:latest each report 4 HIGH / 0 CRITICAL (previous recorded sample: 3 HIGH each); kubeblocks-charts:latest remains clean.
• Scanner/image fetch completed and the jobs failed intentionally on the detected HIGH/CRITICAL totals. GitHub-hosted runners were used; this is security/dependency debt, not self-hosted runner/network/registry instability.

No unchanged-image rerun, ignore/VEX, secret, image, or workflow mutation was performed by patrol.

[khalildai]

2026-07-31 09:58 SGT patrol adds fresh Daily evidence from run 30593232823 on new exact workflow head bd43c347aa01fc48f9e913938e5ae354c7407602.

• kbcli:v1.0.2 remains 33 findings = 3 CRITICAL / 30 HIGH. Representative fixed-version findings include containerd v1.7.29 -> 1.7.32, pgx v5.6.0 -> 5.9.0, and grpc v1.74.2 -> 1.79.3/1.82.1.
• apecloud/kubeblocks:latest, kubeblocks-tools:latest, and kubeblocks-dataprotection:latest each remain 4 HIGH / 0 CRITICAL; kubeblocks-charts:latest remains clean. Current shared findings include golang.org/x/text v0.37.0 -> 0.39.0 and the Go os.Root symlink-following vulnerability with fixed Go releases listed by Trivy.
• Scanner/database setup and all image scans completed; both GitHub-hosted jobs failed intentionally on the HIGH/CRITICAL totals. This is unchanged security/dependency debt, not self-hosted runner, network, or registry instability.

No unchanged-image rerun, ignore/VEX, secret, image, workflow, or release mutation was performed by patrol.