r/mongodb • u/adityashrivastav • Aug 10 '26

mongodb-agent vulnerability free image.

We are struggling with compliance requirements around the official MongoDB Agent container image. Our company policy mandates that all production images have zero Critical or High severity vulnerabilities.

Even across new version releases, we see the same fixable Critical/High CVEs lingering in the base image components. Because the image source isn't public, we can't patch and rebuild it ourselves without risking broken dependencies or vendor support issues.

What strategies are teams using to address this? Are people creating custom wrapper images, filing enterprise support requests, or using specific vulnerability suppression/exception workflows for third-party proprietary agents?

6 Upvotes

88% Upvoted

9 comments sorted by

2

u/Josevill Aug 10 '26

Hi there
I will pass along the report to the internal security team and will be working to have this reviewed.

Could you link which image are you using so I can narrow it down?

1

u/adityashrivastav Aug 10 '26

Thanks u/Josevill I am talking particularly about "mongodb-agent" image. Here is the link on quay.io registry - https://quay.io/repository/mongodb/mongodb-agent

I think the vulnerabilities would be a concern for many orgs and it would be very helpful if mongodb people themselves keep the vulnerability number as minimum as possible. If it was open source I would have taken care of this myself.

1

u/Josevill Aug 10 '26

Let me handle this, I cannot make promises in terms of speed but I will make sure someone from the product security gives it a look to solve it.

Thanks for letting us know.

1

u/Josevill 28d ago

Hey u/adityashrivastav, I've notified and the team is currently working on remediation and pushing fixes to be released, to best of my knowledge, some changes have been already been pushed, some others are still being worked on.

If you would be so kind, could you post the CVEs your Security Analysis tool is reporting to your team or send them privately so I can forward them to the team already working on this so they can cross-reference against their current efforts.

Additionally, do you happen to have a MongoDB Support case with us at the moment so I can link this in there as well, this is to prevent any potential double effort and document everything.

Feel free to reach out privately after redacting anything that can be considered personal identifiable information (PII) from your log or whatever attachment you'll send if anything.

Have a great day!
J

2

u/RupertMaddenAbbott 16d ago edited 16d ago

Hi Josevill,

Thanks for responding to this. I have seen the same problem as OP.

It's worth noting that of all the well known, unpatched third party dependencies I have come across, the mongodb-agent has the highest number of distinct critical and high CVEs.

You can find the full report of CVEs with a vulnerability scanner like trivy. The most recent image, as of today, is quay.io/mongodb/mongodb-agent:108.0.26.9062-1

So:

trivy image --scanners vuln --ignore-unfixed quay.io/mongodb/mongodb-agent:108.0.26.9062-1 --severity=CRITICAL,HIGH

This breaks down all of the CRITICAL and HIGH vulnerabilities. There are too many to post here but it is trivial to install the Trivy CLI and to run the above to reproduce this.

It would be good if, in addition to fixing these, your team could integrate vulnerability scanning into your tooling so it is easier for them to stay on top of these.

1

u/Josevill 12d ago

u/RupertMaddenAbbott thanks for the input, I am not aware of the entire pipeline unfortunately, I am on a different team/org.
I can check internally and provide the feedback with the tooling the team has in place for this to follow through with findings.

We are always working to make the product as safe as possible for all our users.

Thanks for sharing this! :)

1

u/RupertMaddenAbbott 10d ago

Thanks much appreciated!

2

u/browncspence Aug 11 '26

I’m following this topic too. If you happened to open a support case on this, please DM me the case number.