Problem
In some cases, CVEs may be partially or fully mitigated by the infrastructure an application is running on.
For example, when a Kubernetes Deployment is configured with a restrictive security context, such as enabling a read-only root filesystem (readOnlyRootFilesystem: true), certain vulnerabilities that rely on arbitrary file read and write access can be partially or entirely neutralized.
Currently, these CVEs are still reported alongide with their original severity, even though the effective attack surface is reduced by the hardening configuration. Being able to track or annotate these vulnerabilities as mitigated or partially mitigated would provide a more accurate risk assessment.
This would help users better prioritize remediation efforts, focusing first on high-severity CVEs that the underlying infrastructure or runtime configuration cannot neutralize.
Proposal
To achieve this, I would propose of adding a new status label (partially_mitigated) to identify these situations.
Problem
In some cases, CVEs may be partially or fully mitigated by the infrastructure an application is running on.
For example, when a Kubernetes Deployment is configured with a restrictive security context, such as enabling a read-only root filesystem (
readOnlyRootFilesystem: true), certain vulnerabilities that rely on arbitrary file read and write access can be partially or entirely neutralized.Currently, these CVEs are still reported alongide with their original severity, even though the effective attack surface is reduced by the hardening configuration. Being able to track or annotate these vulnerabilities as mitigated or partially mitigated would provide a more accurate risk assessment.
This would help users better prioritize remediation efforts, focusing first on high-severity CVEs that the underlying infrastructure or runtime configuration cannot neutralize.
Proposal
To achieve this, I would propose of adding a new status label (
partially_mitigated) to identify these situations.