Chainguard Report Finds 97% of Observed Vulnerability Instances Outside Top 20 Projects
Summary
Chainguard analyzed 2,400+ container image projects and found 18,016 vulnerability instances across 886 CVEs from March–May 2026. It reports that 97% of instances were outside the top 20 projects.
Key points
- The report covers Chainguard’s customer-portfolio data from March 1 to May 31, 2026, including more than 2,400 container image projects.
- Chainguard observed 18,016 vulnerability instances across 886 distinct CVEs; 63.1% of instances were high severity.
- Of the observed instances, 17,471—97%—were outside the 20 most-used projects.
- Python, Node, and NGINX were the most commonly used container images in the analyzed environments, appearing in 65.6%, 60.6%, and 44.2%, respectively.
- The report says widely used libraries and transitive dependencies underpin many applications, and argues that supply-chain risk extends beyond top-level dependencies.
- Chainguard attributes increased vulnerability findings partly to improved scanning, security research, and AI-assisted discovery; the figures come from its own customer data.
Article Details
- Publisher
- Chainguard
- Report Period
- 2026-03-01 to 2026-05-31
- Scope
- Anonymous customer-portfolio usage and vulnerability data covering container images and libraries; over 2,400 unique container image projects.
- Sample Size
- 18,016 vulnerability instances across 886 distinct CVEs; usage environments analyzed across Chainguard customer data.
- Key Statistics
- 886 distinct CVEs were remediated from March through May 2026, compared with 377 in the prior quarter and 154 in December 2025.
- High-severity vulnerabilities accounted for 11,368 of 18,016 vulnerability instances (63.1%), a 13.1% increase quarter-over-quarter.
- 17,471 of 18,016 vulnerability instances (97%) occurred outside the top 20 projects; 545 occurred within the top 20.
- Python appeared in 65.6% of analyzed customer environments, Node in 60.6%, and NGINX in 44.2%.
- In analyzed FIPS customer environments, Python FIPS appeared in 54.5%, Node FIPS in 49.6%, and NGINX FIPS in 45.5%.
- Recommendations
- Maintain visibility across the full dependency graph, including transitive and long-tail dependencies, rather than focusing only on top-level or most-used projects.
- Prioritize and remediate vulnerability findings according to their significance, given the growing volume of discovered vulnerabilities.
- Standardize trusted foundations and apply consistent security and compliance requirements across environments.
Vendors
Products
Chainguard ContainersThis edition of The State of Trusted Open Source is the first to include Chainguard Libraries data alongside Chainguard Containers.Chainguard LibrariesThis edition of The State of Trusted Open Source is the first to include Chainguard Libraries data alongside Chainguard Containers.