Trivy High Vulnerability One Week

Runbook for a high vulnerability that has persisted in an external-facing image for more than 1 week. Lower priority than critical but still requires remediation within the 6-week high-vuln SLO.

Meaning

Same as 13-trivy-critical-vulnerability-1w but with severity=~"(?i)high" instead of critical. The trivy_vulnerability_id metric is filtered to high-severity CVEs.

Impact

A known high-severity CVE is present in an external-facing service. Less urgent than critical but still a security risk — the 6-week remediation SLO (see 16-trivy-high-vulnerability-6w) starts from when the vuln first appeared.

Diagnosis

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Diagnosis.

Mitigation

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Mitigation.

Verify

See 07-kubernetes/13-trivy-critical-vulnerability-1w.md § Verify.

Notes

• Severity — high (warning), priority 3. Less urgent than critical (priority 2) but ahead of the SLO-breach escalation.
• SLO — high vulns must be remediated within 6 weeks. See 07-kubernetes/16-trivy-high-vulnerability-6w.md for the SLO-breach alert.
• See 07-kubernetes/13-trivy-critical-vulnerability-1w.md Notes for scope, scrape interval, and store-gateway dependency details.