Pack CVE Policy

Most Spectro Cloud packs bundle third-party, open source, and vendor software so that you can deploy them consistently across your clusters. Because packs include upstream software, they inherit any known Common Vulnerabilities and Exposures (CVEs) in that software. This page explains how Spectro Cloud scans packs for CVEs, how we decide what to remediate, and what you can expect when you scan a pack yourself.

This policy applies to Verified Packs distributed by Spectro Cloud. It describes our operating practice for vulnerability handling and does not change the terms of your support agreement.

Summary

• Not all packs are the same. Some layers of a cluster are required, such as the Kubernetes distribution, CNI, and CSI, even though you choose which pack fills them. Other layers are optional add-ons. Separately, some packs are built and owned by Spectro Cloud, while others package third-party upstream software.

• Every pack update is scanned for known CVEs as part of the build and validation process.

• Spectro Cloud reports CVEs for each pack in the Pack CVE tab on the corresponding pack's page. When a fix is available upstream, we incorporate the fix into a new version of the pack. For CVEs with no available upstream fix, we track them in the Pack CVE tab until a fix is available upstream.

• Spectro Cloud keeps packs at or near the latest upstream release so that available fixes are picked up promptly.

• Per-pack CVE data is not published in the Spectro Cloud documentation. For questions about CVEs in a specific pack, contact Spectro Cloud support.

Pack CVEs

A pack is a packaged distribution of upstream software, such as a monitoring stack, an ingress controller, or a logging pipeline. A single pack often includes multiple container images, and each image is built on a base operating system layer and language runtimes, such as Go or Node.js, in addition to the application itself.

CVEs in a pack can originate from any of these layers.

Source	Examples	Who Fixes It
Spectro Cloud software	Spectro Cloud owns the code	Spectro Cloud
Application software	The upstream project's own code	The upstream project
Language runtimes and libraries	Go, npm, and similar dependencies	Upstream project picks up patched runtime and library versions
Base operating system	OS packages in the container base image	The base image provider; upstream project rebuilds on it

Because a pack aggregates multiple images and multiple layers, raw CVE counts can appear large. A high total often reflects accumulated base OS and library findings across the images, although exploitable flaws in the application itself are also included.

Scans

• When: CVE scans execute automatically as part of the validation process for every pack update, before the pack is released.

• What is reported: We scan for available fixes. This means we identify CVEs for which a fixed version exists upstream in the NIST database. These are the actionable CVEs.

• CVEs with no available fix: CVEs that have no fix available anywhere upstream are not actionable, because no software update resolves them. They are tracked and remediated once the upstream project ships a fix. This is the same principle we apply to our appliance and base OS images, where base operating systems routinely carry critical and high CVEs that have no available fix.

Remediation

Our remediation approach depends on whether an upstream fix exists.

CVE State	What We Do
Fix available upstream, pack is on the latest version	The fix is already incorporated; no further action is needed.
Fix available upstream, pack is behind the latest version	We update the pack to the upstream version that contains the fix.
No fix available upstream	We update the pack to the latest available version. We also track the CVE and remediate it once the upstream project ships a fix and we pick that version up.

Upstream Version Tracking

We continuously track upstream releases and target the latest available upstream version of each pack in our regular release cadence. This is the primary way fixes reach you. When an upstream project patches a vulnerability, we pick up the patched version promptly.

Some upstream projects release frequently, sometimes more than once per week. In those cases, a pack may briefly trail the newest upstream release, and that gap is normally closed within a subsequent release cycle.

Exceptions for Severe CVEs

For the most severe CVEs with a 10.0 Common Vulnerability Scoring System (CVSS) score where the upstream project has not released a fix, we may take an additional mitigation step rather than waiting. For example, when a vulnerability originates in a language runtime such as Go, we can rebuild affected images using an updated, patched runtime to remove the vulnerability ahead of the upstream application's own fix.

When the upstream project later ships its own fix, subsequent pack versions return to the standard upstream-tracking process. The temporary mitigation is not carried forward.

CVE Disclosure

Per-pack CVE data is not published in the Spectro Cloud documentation. For questions about CVEs in a specific pack, contact Spectro Cloud support.

Frequently Asked Questions (FAQs)

Does Spectro Cloud Patch Third-Party Software in a Pack?

For most CVEs, remediation comes from updating to the upstream version that contains the fix. We do not fork or independently patch upstream application code. The exception is the severe-CVE mitigation for a runtime rebuild, where we may rebuild with an updated runtime ahead of the upstream fix.

Why Do Some Packs Show High CVE Counts?

A pack contains multiple images, each with an OS layer, runtimes, and the application. Counts aggregate findings across all of these. Many are base OS or library findings without an available fix, or are non-exploitable in context. We focus on CVEs that have an available upstream fix.

Why Does a Pack Still Report a CVE That Has a Published Fix?

A fix being available in the vulnerability database does not mean the upstream project has already incorporated it into its release. We treat such CVEs as actionable and update the pack once an upstream version that includes the fix is available.

Are Packs Always on the Latest Upstream Version?

We target the latest upstream version for each pack on our regular cadence. High-frequency upstream projects may briefly trail the newest release, and lower-priority packs may occasionally lag by a version or two. In all cases, we aim to incorporate available fixes promptly.

Where Can I Find the CVEs for a Specific Pack?

Per-pack CVE data is not published in the Spectro Cloud documentation. For questions about a specific pack, contact Spectro Cloud support. You can also scan the pack yourself using open source vulnerability scanners such as Trivy or Grype.