Back to Checks
azure

All Azure running container images in the subscription have no unresolved vulnerabilities

defender_container_images_resolved_vulnerabilities
Service: defenderSeverity: critical
OfficialBuilt-inVerified
Categories:vulnerabilitiescontainer-security
Resource Type:microsoft.security/assessmentssample

Running container images are evaluated for unresolved vulnerability findings (CVEs) reported by Microsoft Defender for Cloud. The check reviews images currently in use across Kubernetes workloads and identifies where vulnerabilities remain unremediated.

Prowler logoProwlerprowler-provider-azure

Risk

Unremediated CVEs in active images enable:

  • RCE, container escape, and node takeover affecting integrity/availability
  • Data exfiltration and secret theft compromising confidentiality Adversaries can use public exploits to pivot across clusters and pipelines, tamper images, and disrupt services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_container_images_resolved_vulnerabilities

Recommendation

Adopt risk-based patching and least privilege:

  • Rebuild from updated bases; pin versions, avoid latest
  • Sign images; enforce admission control to block high-severity CVEs
  • Drop root, restrict capabilities, isolate networks
  • Continuously scan in CI/CD and at runtime; retire vulnerable images

Remediation

CLI

kubectl set image deployment/<DEPLOYMENT_NAME> <CONTAINER_NAME>=<PATCHED_IMAGE:TAG> -n <NAMESPACE>

Terraform

resource "kubernetes_deployment" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    selector {
      match_labels = { app = "<example_resource_name>" }
    }
    template {
      metadata { labels = { app = "<example_resource_name>" } }
      spec {
        container {
          name  = "<example_resource_name>"
          image = "<patched_image:tag>" # Critical: use a patched image version to remove known vulnerabilities
        }
      }
    }
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud > Recommendations
2Open "Azure running container images should have vulnerabilities resolved"
3Under Affected resources, select a running workload and view its vulnerable image findings
4Rebuild the image with patched packages or a newer base image and push it to your registry
5Go to your AKS cluster > Workloads > Deployments, edit the deployment, and update the container image to the patched tag; Save
6Wait for pods to roll out and Defender to rescan; the recommendation should turn Healthy after the next scan

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_container_images_resolved_vulnerabilities(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            assessments,
        ) in defender_client.assessments.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if (
                "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)"
                in assessments
                and getattr(
                    assessments[
                        "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)"
                    ],
                    "status",
                    "NotApplicable",
                )
                != "NotApplicable"
            ):
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=assessments[
                        "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)"
                    ],
                )
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Azure running container images do not have unresolved vulnerabilities in subscription '{subscription_name} ({subscription_id})'."
                if (
                    assessments[
                        "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)"
                    ].status
                    == "Unhealthy"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Azure running container images have unresolved vulnerabilities in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References