home / N8N / n8nio/n8n:2.43.7-b7c5430-pc n8nio/n8n:2.43.7-b7c5430-pc docker pull n8nio/n8n:2.43.7-b7c5430-pc click to select
Image metadata PULL COUNT
274.3M
repository-level (not per-tag)
RUNS AS
non-root
image config.User
LAST PUSHED
5d ago
2026-10-16 07:19:31
MANIFEST DIGEST
sha256:ca07e5f86304…
from registry manifest
Latest scan 2026-10-18 03:07:50 UTC · 3d ago OPEN CVES BY SEVERITY
Grype DB 2026-10-11T06:30:42.000Z
· rubric cerodeo-v1
RUBRIC BREAKDOWN (10 signals that moved the score) -425 · Critical CVEs (fixable) -630 · High CVEs (fixable) -273 · Medium CVEs (fixable) -8 · Critical CVEs (no fix) -36 · High CVEs (no fix) +10 · Runs as non-root +10 · Rebuilt in last 90 days +3 · OCI standard labels (≥4) +2 · Multi-arch +2 · readme_has_example
Raw data
Every signal above decomposes to arithmetic from inputs you can verify. Nothing in these downloads is derived or
massaged — they're the raw grype matches and the raw snapshot history exactly as our scanner wrote them.
Reproduce this score yourself
We don't use judgement to score — every signal is deterministic from the image, the manifest, and a pinned CVE DB.
Run the script below on any host with skopeo, syft,
grype, cosign, and jq installed — it fetches the versioned rubric spec, computes the same breakdown, and prints the same grade. Pin the Grype DB with --grype-db to reproduce bit-for-bit identical results.
curl -fsSLO https://ce.rodeo/verify-score.sh && chmod +x verify-score.sh
./verify-score.sh n8nio/n8n:2.43.7-b7c5430-pc \
--rubric cerodeo-v1 \
--grype-db 2026-10-11T06:30:42.000Z
All open CVEs (231) sorted by severity, then CVSS score CVE ID SEV CVSS PACKAGE FIX
CVE-2026-60002 CRITICAL 9.4 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60002 CRITICAL 9.4 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60002 CRITICAL 9.4 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60002 CRITICAL 9.4 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60002 CRITICAL 9.4 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60002 CRITICAL 9.4 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59999 HIGH 7.5 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59999 HIGH 7.5 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59999 HIGH 7.5 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59999 HIGH 7.5 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60000 HIGH 7.5 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60000 HIGH 7.5 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60000 HIGH 7.5 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60000 HIGH 7.5 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59998 MEDIUM 6.5 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59998 MEDIUM 6.5 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59998 MEDIUM 6.5 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59998 MEDIUM 6.5 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59998 MEDIUM 6.5 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59998 MEDIUM 6.5 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60001 MEDIUM 6.5 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60001 MEDIUM 6.5 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60001 MEDIUM 6.5 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60001 MEDIUM 6.5 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60001 MEDIUM 6.5 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-60001 MEDIUM 6.5 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59995 MEDIUM 5.4 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59995 MEDIUM 5.4 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59995 MEDIUM 5.4 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59995 MEDIUM 5.4 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59995 MEDIUM 5.4 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59995 MEDIUM 5.4 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59996 MEDIUM 5.4 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59996 MEDIUM 5.4 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59996 MEDIUM 5.4 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59996 MEDIUM 5.4 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59996 MEDIUM 5.4 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59996 MEDIUM 5.4 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59997 MEDIUM 5.4 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59997 MEDIUM 5.4 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59997 MEDIUM 5.4 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59997 MEDIUM 5.4 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59997 MEDIUM 5.4 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-59997 MEDIUM 5.4 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-73282 MEDIUM 4.8 openssh-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-73282 MEDIUM 4.8 openssh-client-default 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-73282 MEDIUM 4.8 openssh-keygen 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-73282 MEDIUM 4.8 openssh-server-common 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-73282 MEDIUM 4.8 openssh-sftp-server 10.3_p1-r0 fixed in 10.3_p1-r1 CVE-2026-73282 MEDIUM 4.8 openssh-client-common 10.3_p1-r0 fixed in 10.3_p1-r1
Scan history 1 total · first 3d ago SCANNED AT GRADE SCORE CRIT HIGH MED GRYPE DB
3d ago F 0 18 75 110 2026-10-11T06:30:42.000Z
Methodology:
This image is re-matched against the fresh Grype vulnerability DB every hour. Snapshot rows marked
(same SBOM) reuse the prior scan's content via a pointer — about
90% of hourly cycles do. New CVE disclosures land in a new content row and bump the grade on the next match.
Full rubric at /about/grades ; for publishers wanting to
raise their grade, see /about/for-publishers .
Discussion
No comments yet. Be the first.