CVE-Aware Scoring
How Trivy vulnerability scan results integrate into the attack graph edge weights.
Overview
K8sAttackMap integrates Trivy to scan every unique container image found in the cluster, then feeds vulnerability data directly into the edge risk weights used by Dijkstra path finding.
A pod running an image with a critical, remotely exploitable CVE gets a lower-friction traversal score — meaning the attack graph treats it as an easier target, reflecting real attacker economics.
Scanning Process
K8sJsonParserextracts all unique container image references from the cluster JSONTrivyScannerrunstrivy image --format json <image>for each unique imageTrivyJsonParserparses the JSON output, extracting CVE IDs, severity, and CVSS scoresTrivyCachestores results in memory to avoid duplicate scans across runs
# K8sAttackMap internally runs something equivalent to:
trivy image --format json nginx:1.25.3Caching
Trivy scan results are cached per image reference within a single K8sAttackMap run. If the same image appears in multiple pods, it is scanned only once. This significantly reduces analysis time in clusters with many pods sharing common base images.
How CVE Scores Affect Edge Weights
The EdgeRiskScorer applies CVE data as friction reductions:
| CVE Severity | Friction Reduction | Rationale |
|---|---|---|
| CRITICAL (CVSS ≥ 9.0) | −1.5 | Severe vulnerability → very easy to exploit |
| HIGH (CVSS 7.0–8.9) | −0.8 | Significant vulnerability → meaningfully easier |
| MEDIUM (CVSS 4.0–6.9) | −0.2 | Minor friction reduction |
| LOW (CVSS < 4.0) | −0.05 | Negligible effect |
These deductions stack: a pod with multiple critical CVEs will accumulate lower friction, making it an even more attractive attack path entry point.
Score Sources
K8sAttackMap's TrivyJsonParser supports multiple CVSS score sources in priority order:
- NVD — National Vulnerability Database CVSS v3 / v2 scores
- GHSA — GitHub Security Advisory scores
- Red Hat — Vendor-specific scores for RHEL-family images
- Bitnami — Bitnami-specific container image advisories
PDF Report: CVE Summary
The PDF audit report includes a Pod CVE Summary table sorted by CVE count, showing:
- Pod name and namespace
- Container image
- Total CVE count
- Breakdown by severity (Critical / High / Medium / Low)
Implementation Details
security/TrivyScanner.java— invokes the Trivy CLI and collects resultssecurity/trivy/TrivyJsonParser.java— parses Trivy JSON output intoScanResultobjectssecurity/trivy/TrivyCache.java— in-memory cache keyed by image referencesecurity/EdgeRiskScorer.java— applies CVE scores as friction deductions
Trivy Version Compatibility
K8sAttackMap requires Trivy ≥ 0.70.0. The JSON output schema changed in 0.70.0 in ways that affect CVE field availability. Older versions may produce incomplete or missing CVE data.