Trivy Critical Vulnerability Four Weeks

Runbook for a critical vulnerability that has persisted in an external-facing image for more than 4 weeks — the critical-vuln remediation SLO has been breached. This is the escalation tier of 13-trivy-critical-vulnerability-1w.

Meaning

Same as 13-trivy-critical-vulnerability-1w but with offset 4w — the vulnerability was present 4 weeks ago AND is present now, meaning it has survived a full month without remediation. The 4-week window is the critical-vuln remediation SLO; this alert means the SLO is breached.

Impact

A known-critical CVE has been exploitable in an external-facing service for over a month. This is a high-priority security exposure — the vuln has persisted through multiple remediation cycles without action.

Diagnosis

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Diagnosis. To confirm the 4-week age, use offset 4w in the Mimir query.

Mitigation

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Mitigation. This is a priority-1 alert — remediate immediately.

Verify

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Verify.

Notes

• SLO breach — the critical-vuln remediation SLO is 4 weeks. This alert fires when the SLO is breached.
• Escalation of 13-trivy-critical-vulnerability-1w (same expr, offset 4w instead of offset 1w).
• See 07-kubernetes/13-trivy-critical-vulnerability-1w.md Notes for scope, scrape interval, and store-gateway dependency details.