Check whether a reported CVE affects your container

Use chainctl images advisories list to compare the advisories for the APK packages in an image with the CVEs reported by your scanner.

Note: This command checks APK packages only. It does not determine whether a CVE affects a Go module, Java dependency, or another non-APK component in the image.

Prerequisites

You need:

• chainctl installed and authenticated.
• An image reference with an SBOM attestation attached.
• The image digest or the exact tag scanned by your scanner. A digest is preferred because tags can move.
• The platform that matches the scanner result. The default platform is linux/amd64.

List advisories for the image

Run the command against the same image reference and platform that your scanner analyzed:

chainctl images advisories list \
  cgr.dev/chainguard/<image>@sha256:<digest> \
  --platform=linux/amd64 \
  -o wide

The output includes the APK package, package version, advisory ID, CVE aliases, status, and advisory type. Compare the package name and version—not only the CVE alias—with the scanner’s finding.

If the image has no SBOM attestation, or the requested platform does not have one, the command cannot use that image to perform the lookup. If no matching advisory is shown, do not treat that alone as proof that the scanner finding is a false positive; first verify the image digest, platform, package ecosystem, package version, and scanner database.

Triage a long scanner report with --status

Use --status to narrow the output to the advisory states you need to review. You can provide multiple values as a comma-separated list, or by repeating the flag:

# Findings that still need attention or confirmation
chainctl images advisories list "$IMAGE" \
  --status=detected,true-positive,pending-upstream

# Findings with a recorded fix or backported patch
chainctl images advisories list "$IMAGE" \
  --status=fixed,patched

# The same filter using repeated flags
chainctl images advisories list "$IMAGE" \
  --status=detected \
  --status=pending-upstream

To inspect one CVE from the table output, filter the displayed aliases after retrieving the results:

chainctl images advisories list "$IMAGE" -o wide | grep 'CVE-2026-42151'

The command filters advisories by their current status. It does not accept a CVE as the primary lookup key, and it does not replace the scanner’s analysis of non-APK components.

Status values

The command reports the status derived from the advisory’s most recent event:

What a missing result means

A missing result can have several explanations:

• The reported component is not an APK package.
• The image reference, digest, or platform differs from the image that was scanned.
• The image does not have an SBOM attestation available to the command.
• The advisory database does not contain a matching advisory for that package and version.
• The scanner and advisory database use different package or version metadata.

A missing result is therefore a prompt to reconcile the two data sources, not a standalone false-positive determination.

When the finding is a Go module or Java dependency

chainctl images advisories list is not the right validation tool for language-level dependencies. Use the scanner’s language-package evidence and the relevant upstream vulnerability data instead.

Go modules

For a Go-module finding:

1. Confirm the module path and version in the image’s SBOM and, where available, in go.mod or go.sum.
2. Confirm that the scanner identified a Go module rather than an APK package with a similar name.
3. Check the module’s upstream advisory and the scanner’s reachability or affected-symbol evidence.
4. Rebuild with a non-vulnerable module version when one is available, then rescan the resulting image.

Do not use an APK advisory result—or the absence of one—to declare a Go-module CVE a false positive.

Java dependencies

For a Java finding:

1. Confirm the Maven or Gradle coordinates and version in the SBOM.
2. Check whether the finding is in a standalone dependency, a shaded JAR, or an application layer.
3. Consult the dependency’s upstream advisory and the scanner’s evidence for the affected class or code path.
4. Upgrade, replace, or otherwise mitigate the dependency, then rebuild and rescan.

A Java dependency finding is distinct from an APK finding in the base image. Use chainctl images advisories list only for the APK portion of the image.

Further troubleshooting

If a result is still unclear, you can contact support. When contacting support, include:

• The image digest and platform.
• The scanner name and database version.
• The CVE and advisory identifiers.
• The detected ecosystem, package/module coordinates, and version.
• The relevant chainctl images advisories list output, preferably in -o wide or JSON form.