Unpatched Container Image Vulnerabilities
容器映像漏洞未修補
Deployment
Risk Description
When an organization's inference service runs on an image built a year earlier and not included in periodic scanning; due to unmitigated control gaps, only after scanning is introduced does the organization discover multiple high-risk vulnerabilities in the image, which has already been deployed across several environments, triggering compliance exposure and operational reputational costs.
Framework Mappings
NIST CSF 2.0PR.PS
ISO/IEC 27001Annex A 8.8
MITRE ATLASAML.T0010
NIST AI 600-1Information Security
ISO/IEC 5338部署
Risk Treatment & Implementation Guidance
Scan container images regularly with patching deadlines for high-risk findings; Minimize images to reduce attack surface; Set image-rebuild cycles prohibiting long-lived stale images