Step 1 / 5

Start with the finding.

The scanner observation keeps immutable identity and remediation context.

CriticalNeeds context

Open findings

Last scan 14:22 UTC

FindingImageRuntimeExposurePriority

DEMO-CVE-2026-0042Fixed in 4.2.7checkout-apisha256:8d2e...c014CheckingUnknown--

DEMO-CVE-2026-0019High severitycatalog-workerInactiveInternal38

DEMO-CVE-2025-0891Medium severityreporting-jobCompletedNone18

SourceSynthetic scanner importObserved2026-08-13 14:22 UTCIdentityImmutable image digest

Step 2 / 5

Prove where it is running.

The digest joins scanner output to the active Kubernetes workload.

6 / 6Active replicas

Vulnerability

DEMO-CVE-2026-0042

Severity: Critical
Image: sha256:8d2e...c014
Fix: Version 4.2.7

same digest

Active workload

checkout-api

Kind: Deployment
Namespace: production
Replicas: 6 ready / 6 desired

owned by

Product context

Checkout API

Criticality: Mission-critical
Owner: Platform Security
Data path: Payment checkout

Evidence ruleEvery join shows source and observation time. A missing match remains unknown.Kubernetes API 14:23 UTC

Step 3 / 5

Verify exposure.

Reachability comes from an ingress route and observed flow summary.

PublicTLS / 443

01Public edgeInternet

recent traffic

02checkout.example.invalidIngress / TCP 443

routes to

03checkout-apiService / production

selects

046 active podssha256:8d2e...c014

Route sourceKubernetes Ingress API

Traffic sourceSynthetic flow summary

Payload storageNot retained

ConfidenceVerified

Step 4 / 5

Explain the priority.

Runtime, exposure and criticality move this finding ahead of stale scanner rows.

96of 100

96Priority

Vulnerability severity40 / 40

Active runtime20 / 20

Public exposure20 / 20

Business criticality16 / 20

Step 5 / 5

Export the decision.

Security, engineering and compliance review the same evidence case.

ReadyReview package

PUBLIC DEMO / SYNTHETIC DATACM-DEMO-2026-0042

Critical finding on the public Checkout API

A synthetic critical vulnerability is present in an immutable image running six replicas behind a public TLS ingress.

96 / 100priority

24 hoursaction window

3 reviewersdecision record

Evidence chain

ScannerCVE and fixed version14:22
KubernetesActive workload and image digest14:23
Ingress / flowPublic route and recent traffic14:25
Product registerCriticality and owner14:24