[Bug]: Latest Nvidia GPU Operator v26.7.1 reports large numbers of critical and high CVEs in Trivy scan output

[nikhaild]

Describe the bug
Running Trivy scanner on each of the component container images of GPU Operator v26.7.1 reports following CVEs:

Severity	Count	Score range
Critical	49	[9.0-10]
High	3776	[7.0,9.0)
Medium	8671	[4.0,7.0)
Low	265	[1.0,4.0)

Attached zip file nvidia-gpu-operator-cve-scan-results.zip
contains:

• Raw trivy json format reports
• CVS format summary grouped into per-severity directory (containing per container image csv data CVE ID, CVE score, package name, package version)
• A script to transform json raw data into CVS data

To Reproduce

• Enumerate all container images from GPU Operator helm chart
• Run trivy scanner to generate json format report per container image, e.g.

docker run --rm aquasec/trivy:0.74.0 image --format json "<container-image-path>" > "<container-image-name-version.json>"

• Run the json2csv.sh script to generate CVE report, summary.

Expected behavior

Our customers deploying Nvidia GPU Operator have a security policy prohibiting OSS packages with any Critical and High CVEs (i.e. CVE score >= 7.0), their policy requires

• either fixes to CVEs
• or per-CVE non-exploitability confirmation/explanation
• or per-CVE mitigation actions

Environment (please provide the following information):

• GPU Operator Version: v26.7.1
• OS: Ubuntu 24.04.4 LTS
• Kernel Version: 6.17.0-35-generic
• Container Runtime Version: containerd://2.2.5+vmware.1-fips
• Kubernetes Distro and Version: VMware Kubernetes Service - VMware Kubernetes Release v1.35.6+vmware.1

[rahulait]

Hi @nikhaild, thanks for sharing the reports and your customers’ security requirements.

Please refer to the GPU Operator security-scan results on NGC. Components are released as separate images, so please also check the corresponding NGC results for each image and tag where available.

To help us validate the findings and route them to the appropriate component owners, could you refine the report as follows?

• Clarify what the totals count. Separate unique CVE IDs from image/package/CVE occurrences. The same vulnerability may appear in multiple packages and images.
• Identify the affected images. Include the exact image reference, digest, and architecture, and distinguish images deployed in your environment from optional components included in the chart.
• Provide a per-finding breakdown. For each Critical or High finding, include the CVE ID, package name, installed version, fixed version if available, and severity source.
• Include scan metadata. Provide the scan date and Trivy vulnerability-database version.
• Share any existing applicability analysis. Include relevant vendor advisories or differences from NGC results, if available. Demonstrating exploitability is not a prerequisite for reporting a finding.

The aggregate counts provide an initial signal. These details will help us assess each finding and determine whether it requires an image update, mitigation, or a documented explanation of why it does not apply.

[nikhaild]

Thank you @rahulait for taking a look!

To help us validate the findings and route them to the appropriate component owners, could you refine the report as follows?

• Clarify what the totals count. Separate unique CVE IDs from image/package/CVE occurrences. The same vulnerability may appear in multiple packages and images.

The table at the top shows per "Debian package name+version" CVE count ((if that Debian package is used in multiple container images. it's still counted as one occurrence for that {CVE_ID, DebianPackage Name+Version}. E.g. for Critical CVEs:

"CVE-2019-1010022","9.8","libc-bin","2.41-12+deb13u4"
"CVE-2019-1010022","9.8","libc6","2.41-12+deb13u3"
"CVE-2019-1010022","9.8","libc6","2.41-12+deb13u4"
"CVE-2019-12900","9.8","bzip2-libs","1.0.8-8.el9"
...

(I chose this format since the unit of work for "keep something updated" is often at a OS distro package level.)

• Identify the affected images. Include the exact image reference, digest, and architecture, and distinguish images deployed in your environment from optional components included in the chart.
• Provide a per-finding breakdown. For each Critical or High finding, include the CVE ID, package name, installed version, fixed version if available, and severity source.

All this data is available as *.csv files under following dirs in the attached zip file above.

Alright, here's a flattened single .csv that has these columns, hope this helps?

"Container_Image","CVE_ID","CVSS_Score","Package_Name","Package_Version"

All images are for amd64. I don't have the digests for container images, only the image:tag (see the first column in above .csv).

gpu-operator-v26.7.1-all-CVEs.csv

• Include scan metadata. Provide the scan date and Trivy vulnerability-database version.

Trivy version is "0.74.0", unfortunately, I don't have trivy scan DB download output for the DB version,
trivy scan was run (using docker run command mentioned in the issue description) roughly around
this timestamp: 2026-09-23T07:46:48

Thanks,
Nikhil

[nikhaild]

Please refer to the GPU Operator security-scan results on NGC.

@rahulait , interestingly above portal shows 0 Critical CVEs for the gpu-operator:v26.7.1 image.

However when I check the Trivy output, it claims 1 Critical CVE:

$ cat Critical/nvcr.io_nvidia_gpu-operator_v26.7.1.csv
"CVE ID","CVSS Score","Package Name","Package Version"
"CVE-2019-1010022","9.8","libc6","2.41-12+deb13u4"

And the package version Trivy detected seems about right:

 $ docker run -it --rm --entrypoint /bin/sh nvcr.io/nvidia/gpu-operator:v26.7.1 -c "cat /var/lib/dpkg/status.d/libc6" | head -n 4
Package: libc6
Source: glibc
Version: 2.41-12+deb13u4
Architecture: amd64

This container is using Debian Trixie base image:

$ docker run -it --rm --entrypoint /bin/sh nvcr.io/nvidia/gpu-operator:v26.7.1 -c "cat /etc/os-release" | head -n 5
PRETTY_NAME="Distroless"
NAME="Debian GNU/Linux"
ID="debian"
VERSION_ID="13"
VERSION="Debian GNU/Linux 13 (trixie)"

and if I cross check this CVE on Debian CVE tracker, it does claim glibc 2.41-12+deb13u4 is vulnerable to CVE-2019-1010022
https://security-tracker.debian.org/tracker/CVE-2019-1010022

glibc ...
         trixie | 2.41-12+deb13u4 | vulnerable

For whatever reasons, NGC scanner results for this image/package/version doesn't match Trivy/Debian info though.
(If it's not exploitable for the gpu-operator "operating environment", the customer ask is confirmation with explanation for such instances.)