This repository has been renamed or transferred. GitHub now serves it under a different name, so these findings are the superseded original from 29 Jul 2026. The current scan is stored separately, under the new name.

Scan report

envoyproxy / ai-gateway

View on GitHub (opens in a new tab)
Go
1477 stars
Scanned 29 Jul 2026, 15:18

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

60 risk score

Real issues worth reviewing before you rely on this code.

High: 4
Medium: 25
Low: 12

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

41 total findings

Likely real: 4
Uncertain: 13
Likely noise: 24

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 60, which means there are several insecure coding patterns that an attacker could exploit to break into your system. The scan did not find any signs of malicious intent, so the issues appear to be ordinary mistakes rather than deliberate attacks. However, because the code contains many unencrypted connections and potential security flaws, it is not safe to use without fixing these problems first. You should treat this as a high-risk project until you have addressed all the flagged issues in your own codebase.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 40

Pattern-based code analysis · Vulnerability
Bandit 1

Python security linter · Vulnerability

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/cmd/aigw/run.go line 176

Likely real
Yes, 99% confidence

Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/testing/testotel/collector.go line 98

Likely real
Yes, 99% confidence

Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/mcp/mcp_oauth_example.yaml line 6

Likely real
Uncertain, 49% confidence

JWT token detected
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/cmd/aigw/stdio2http.go line 51

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/testing/ollama.go line 62

Likely real
Yes, 99% confidence

Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/autoconfig/config.go line 16

Likely real
Yes, 50% confidence

When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not automatically escape HTML content, which can leave your application vulnerable to these types of attacks. To mitigate this risk, it's recommended to use the `html/template` package instead, which provides built-in functionality for HTML escaping. By using `html/template` to render your HTML content, you can help to ensure that your web application is more secure and less susceptible to XSS vulnerabilities.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/src/components/ApiField.tsx line 47

Likely real
Uncertain, 46% confidence

Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/src/components/ApiField.tsx line 63

Likely real
Uncertain, 46% confidence

Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/src/components/ApiField.tsx line 77

Likely real
Uncertain, 46% confidence

Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/mcpproxy/handlers.go line 575

Likely real
Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/mcpproxy/handlers.go line 1164

Likely real
Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/mcpproxy/handlers.go line 815

Likely real
Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/internal/mcpproxy/handlers.go line 176

Likely real
Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
```
requires login
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/tests/internal/testopeninference/openai_proxy.py line 147

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
146     import uvicorn
147     uvicorn.run(app, host="0.0.0.0", port=8080)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/src/plugins/latestBlogsPlugin.ts line 27

Likely real
Uncertain, 36% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/src/plugins/latestBlogsPlugin.ts line 35

Likely real
Uncertain, 36% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/site/src/plugins/latestBlogsPlugin.ts line 35

Likely real
Uncertain, 36% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/base.yaml line 121

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/token_ratelimit/token_ratelimit.yaml line 226

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/token_ratelimit/redis.yaml line 50

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/token_ratelimit/envoy-gateway-values-addon.yaml line 32

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/provider_fallback/base.yaml line 175

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/monitoring/monitoring.yaml line 118

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/with-annotations.yaml line 41

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/base.yaml line 285

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/base.yaml line 37

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/basic/basic.yaml line 104

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/access-log/basic.yaml line 162

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/with-annotations.yaml line 128

Likely real
Probably noise, 26% confidence

In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/token_ratelimit/token_ratelimit.yaml line 224

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/token_ratelimit/redis.yaml line 46

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/token_ratelimit/envoy-gateway-values-addon.yaml line 29

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/provider_fallback/base.yaml line 173

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/monitoring/monitoring.yaml line 115

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/with-annotations.yaml line 124

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/with-annotations.yaml line 39

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/base.yaml line 283

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/base.yaml line 116

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/inference-pool/base.yaml line 35

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/basic/basic.yaml line 102

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/examples/access-log/basic.yaml line 160

Likely real
Probably noise, 24% confidence

When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.
```
requires login
```