Reducing False Positives: Addressing Non-Exploitable CVEs in Hardened Kubernetes Environments with Vulnerability Scanners

Traditional Kubernetes scanners (e.g., Trivy, Grype) often flag CVEs that are theoretically present but practically non-exploitable.

Scanners analyze container images in isolation and do not incorporate runtime security contexts or Kubernetes hardening settings.

Hardening like readOnlyRootFilesystem: true, read-only mounts, runAsNonRoot, resource limits, or Pod Security Policies can neutralize exploitation vectors and make some CVEs irrelevant.

This decoupling causes scanners to treat all CVEs as high-priority and forces manual triage because there is no standardized way to communicate environment-specific mitigations.

Vex8s uses an ML model to classify CVE exploitation vectors, correlates them with Kubernetes manifests, and generates an OpenVEX document to suppress non-exploitable CVEs (e.g., a privilege-escalation CVE in a container with runAsNonRoot: true is flagged as non-exploitable).