Vex8s uses Kubernetes securityContext to suppress false-positive CVEs
Suppress vulnerabilities applying Kubernetes context to scans
Vex8s is an experimental tool that generates VEX documents by correlating container vulnerabilities with Kubernetes securityContext settings. It classifies CVEs using an embedded ONNX model or Google's Gemini LLM, then checks if the workload's configuration blocks exploitation. If mitigated, the CVE is suppressed in the VEX output, which can be fed back into Trivy or Grype to reduce noise. The tool supports passive mode with existing reports and active mode for direct scanning.
By parsing a Kubernetes manifest, we can inspect the container settings to evaluate whether the relevant settings are in place.
- alegrey91
vex8s is an open source tool that analyzes Kubernetes workloads and generates VEX documents based on their SecurityContext.
The idea is to distinguish vulnerabilities that are actually exploitable in a given deployment from those mitigated by Kubernetes security settings (for example, readOnlyRootFilesystem, dropped capabilities, non-root users, and read-only volume mounts).
vex8s embeds a ML model trained on CVE data to predict vulnerability classes, then combines those predictions with the workload's security configuration to determine whether a vulnerability can be mitigated.
I'm particularly interested in feedback on the decision logic and on whether this approach could be useful as part of a vulnerability scanning pipeline.