{
  "schemaVersion": "catalog-shared-check-receipt-v1",
  "subject": {
    "id": "longhorn-longhorn-1-11-2-ui-ingress",
    "chart": "longhorn/longhorn",
    "version": "1.11.2",
    "base": "ui-ingress",
    "renderPath": "recipes/longhorn/longhorn/1.11.2/revisions/ui-ingress/r001/rendered/release-objects.yaml",
    "renderFileSHA256": "sha256:2f6508c2bc3f2a09e1ffcb8ec71282b3e2dd52e69fe8ca80fc90ab756f9b9298"
  },
  "catalogReview": {
    "path": "recipes/longhorn/longhorn/1.11.2/revisions/ui-ingress/r001/receipts/scan-receipt.yaml",
    "note": "Separate chart-specific Catalog review; not a cub check result."
  },
  "scannerResult": {
    "schema_version": "risk-scan-findings-v1",
    "surface": "cub-scan",
    "finding_count": 27,
    "findings": [
      {
        "id": "CCVE-2025-3201",
        "name": "IngressClass not found when Ingress specifies ingressClassName",
        "category": "DEPEND",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "ingress-nginx",
        "resource": {
          "kind": "Ingress",
          "name": "longhorn-ingress",
          "namespace": "longhorn-system"
        },
        "message": "Ingress references missing IngressClass \"nginx\"",
        "remedy_type": "diagnose_then_fix",
        "remedy_safety": "manual_only",
        "remediation": {
          "steps": [
            "Identify which ingressClassName the Ingress resources are using",
            "Check if the corresponding IngressClass exists",
            "Create the missing IngressClass resource",
            "Verify the controller's spec.controller matches the IngressClass",
            "Restart the ingress controller if needed"
          ],
          "commands": [
            "kubectl get ingress -A -o jsonpath='{range .items[*]}{.spec.ingressClassName}{\"\\n\"}{end}' | sort -u",
            "kubectl get ingressclass",
            "cat <<EOF | kubectl apply -f -\napiVersion: networking.k8s.io/v1\nkind: IngressClass\nmetadata:\n  name: nginx\n  annotations:\n    ingressclass.kubernetes.io/is-default-class: \"true\"\nspec:\n  controller: k8s.io/ingress-nginx\nEOF"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-NET-0002"
        ],
        "action_type": "human-decision",
        "next_step": {
          "action": "update_config",
          "description": "Identify which ingressClassName the Ingress resources are using",
          "command": "kubectl get ingress -A -o jsonpath='{range .items[*]}{.spec.ingressClassName}{\"\\n\"}{end}' | sort -u",
          "doc_ref": "cub-scan --explain CCVE-2025-3201"
        }
      },
      {
        "id": "CCVE-2025-3726",
        "name": "Deployment omits pod and container securityContext baseline",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Deployment omits pod and container securityContext settings",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Add pod-level securityContext defaults where appropriate",
            "Add container-level securityContext for least-privilege execution",
            "Validate runAsNonRoot and privilege escalation policy before deploy"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o yaml | grep -A20 securityContext",
            "kubectl patch deployment <name> -n <namespace> --type=merge -p '{\"spec\":{\"template\":{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true}}}}}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Add pod-level securityContext defaults where appropriate",
          "command": "kubectl get deployment <name> -n <namespace> -o yaml | grep -A20 securityContext",
          "doc_ref": "cub-scan --explain CCVE-2025-3726"
        }
      },
      {
        "id": "CCVE-2025-3728",
        "name": "Deployment containers omit resource limits",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Deployment containers omit resource limits",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Add resources.limits for memory and CPU to each container",
            "Add resources.requests to enable proper scheduling",
            "Consider LimitRange defaults at the namespace level"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o yaml | grep -A10 resources",
            "kubectl set resources deployment <name> -n <namespace> --limits=cpu=500m,memory=256Mi --requests=cpu=100m,memory=128Mi"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Add resources.limits for memory and CPU to each container",
          "command": "kubectl get deployment <name> -n <namespace> -o yaml | grep -A10 resources",
          "doc_ref": "cub-scan --explain CCVE-2025-3728"
        }
      },
      {
        "id": "CCVE-2025-3728",
        "name": "Deployment containers omit resource limits",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Deployment containers omit resource limits",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Add resources.limits for memory and CPU to each container",
            "Add resources.requests to enable proper scheduling",
            "Consider LimitRange defaults at the namespace level"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o yaml | grep -A10 resources",
            "kubectl set resources deployment <name> -n <namespace> --limits=cpu=500m,memory=256Mi --requests=cpu=100m,memory=128Mi"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Add resources.limits for memory and CPU to each container",
          "command": "kubectl get deployment <name> -n <namespace> -o yaml | grep -A10 resources",
          "doc_ref": "cub-scan --explain CCVE-2025-3728"
        }
      },
      {
        "id": "CCVE-2025-3732",
        "name": "Deployment containers omit resource requests",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Deployment containers omit resource requests; HPA and scheduler decisions will be unreliable",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set resources.requests.cpu and resources.requests.memory on every container",
            "Align requests with observed steady-state usage",
            "Ensure requests are set when using HPA"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set resources.requests.cpu and resources.requests.memory on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3732"
        }
      },
      {
        "id": "CCVE-2025-3732",
        "name": "Deployment containers omit resource requests",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Deployment containers omit resource requests; HPA and scheduler decisions will be unreliable",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set resources.requests.cpu and resources.requests.memory on every container",
            "Align requests with observed steady-state usage",
            "Ensure requests are set when using HPA"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set resources.requests.cpu and resources.requests.memory on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3732"
        }
      },
      {
        "id": "CCVE-2025-3733",
        "name": "Container does not set runAsNonRoot",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-driver-deployer does not set runAsNonRoot: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.runAsNonRoot to true at pod or container level",
            "Set runAsUser to a non-zero UID",
            "Ensure container images do not require root"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.runAsNonRoot to true at pod or container level",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3733"
        }
      },
      {
        "id": "CCVE-2025-3733",
        "name": "Container does not set runAsNonRoot",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-ui does not set runAsNonRoot: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.runAsNonRoot to true at pod or container level",
            "Set runAsUser to a non-zero UID",
            "Ensure container images do not require root"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.runAsNonRoot to true at pod or container level",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3733"
        }
      },
      {
        "id": "CCVE-2025-3734",
        "name": "Container does not disable allowPrivilegeEscalation",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-driver-deployer does not set allowPrivilegeEscalation: false",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.allowPrivilegeEscalation to false on every container",
            "Ensure no setuid binaries are needed in the container image"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.allowPrivilegeEscalation to false on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3734"
        }
      },
      {
        "id": "CCVE-2025-3734",
        "name": "Container does not disable allowPrivilegeEscalation",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-ui does not set allowPrivilegeEscalation: false",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.allowPrivilegeEscalation to false on every container",
            "Ensure no setuid binaries are needed in the container image"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.allowPrivilegeEscalation to false on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3734"
        }
      },
      {
        "id": "CCVE-2025-3735",
        "name": "Container does not enforce readOnlyRootFilesystem",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-driver-deployer does not set readOnlyRootFilesystem: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.readOnlyRootFilesystem to true on every container",
            "Use emptyDir or tmpfs mounts for directories that need write access"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.readOnlyRootFilesystem to true on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3735"
        }
      },
      {
        "id": "CCVE-2025-3735",
        "name": "Container does not enforce readOnlyRootFilesystem",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-ui does not set readOnlyRootFilesystem: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.readOnlyRootFilesystem to true on every container",
            "Use emptyDir or tmpfs mounts for directories that need write access"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.readOnlyRootFilesystem to true on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3735"
        }
      },
      {
        "id": "CCVE-2025-3736",
        "name": "Container does not drop ALL capabilities",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-driver-deployer does not drop ALL capabilities",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.capabilities.drop to [\"ALL\"] on every container",
            "Add back only specifically needed capabilities via capabilities.add"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext.capabilities}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.capabilities.drop to [\"ALL\"] on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext.capabilities}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3736"
        }
      },
      {
        "id": "CCVE-2025-3736",
        "name": "Container does not drop ALL capabilities",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-ui does not drop ALL capabilities",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.capabilities.drop to [\"ALL\"] on every container",
            "Add back only specifically needed capabilities via capabilities.add"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext.capabilities}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.capabilities.drop to [\"ALL\"] on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext.capabilities}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3736"
        }
      },
      {
        "id": "CCVE-2025-3740",
        "name": "Deployment explicitly sets replicas to 1",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "info",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Deployment has replicas: 1; no high availability",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set replicas to at least 2 for services requiring availability",
            "Use HPA with minReplicas >= 2 for auto-scaling workloads",
            "Single replica is acceptable for batch jobs or development"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.replicas}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set replicas to at least 2 for services requiring availability",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.replicas}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3740"
        }
      },
      {
        "id": "CCVE-2025-3745",
        "name": "emptyDir volume has no sizeLimit",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "info",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Volume nginx-cache uses emptyDir without sizeLimit; may exhaust node disk",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set sizeLimit on all emptyDir volumes",
            "Size the limit based on expected usage with headroom",
            "{'Consider using memory-backed emptyDir (medium': 'Memory) for small caches'}"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.volumes}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set sizeLimit on all emptyDir volumes",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.volumes}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3745"
        }
      },
      {
        "id": "CCVE-2025-3746",
        "name": "Deployment does not disable automountServiceAccountToken",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-driver-deployer",
          "namespace": "longhorn-system"
        },
        "message": "Deployment does not set automountServiceAccountToken: false; pods get unnecessary API credentials",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set automountServiceAccountToken to false in the pod spec",
            "Only enable it for pods that genuinely need Kubernetes API access",
            "Use dedicated service accounts with minimal RBAC for pods that need API access"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-RBAC-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set automountServiceAccountToken to false in the pod spec",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3746"
        }
      },
      {
        "id": "CCVE-2025-3746",
        "name": "Deployment does not disable automountServiceAccountToken",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "longhorn-ui",
          "namespace": "longhorn-system"
        },
        "message": "Deployment does not set automountServiceAccountToken: false; pods get unnecessary API credentials",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set automountServiceAccountToken to false in the pod spec",
            "Only enable it for pods that genuinely need Kubernetes API access",
            "Use dedicated service accounts with minimal RBAC for pods that need API access"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-RBAC-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set automountServiceAccountToken to false in the pod spec",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3746"
        }
      },
      {
        "id": "CCVE-2025-3755",
        "name": "DaemonSet container does not set runAsNonRoot",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "DaemonSet",
          "name": "longhorn-manager",
          "namespace": "longhorn-system"
        },
        "message": "Container longhorn-manager does not set runAsNonRoot: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.runAsNonRoot to true at pod or container level",
            "Set runAsUser to a non-zero UID"
          ],
          "commands": [
            "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.runAsNonRoot to true at pod or container level",
          "command": "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3755"
        }
      },
      {
        "id": "CCVE-2025-3756",
        "name": "DaemonSet containers omit resource limits",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "DaemonSet",
          "name": "longhorn-manager",
          "namespace": "longhorn-system"
        },
        "message": "DaemonSet containers omit resource limits",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set resources.limits.cpu and resources.limits.memory on every container",
            "Size limits based on observed steady-state usage with headroom"
          ],
          "commands": [
            "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set resources.limits.cpu and resources.limits.memory on every container",
          "command": "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3756"
        }
      },
      {
        "id": "CCVE-2025-3757",
        "name": "DaemonSet containers omit resource requests",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "DaemonSet",
          "name": "longhorn-manager",
          "namespace": "longhorn-system"
        },
        "message": "DaemonSet containers omit resource requests; HPA and scheduler decisions will be unreliable",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set resources.requests.cpu and resources.requests.memory on every container",
            "Align requests with observed steady-state usage"
          ],
          "commands": [
            "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set resources.requests.cpu and resources.requests.memory on every container",
          "command": "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3757"
        }
      },
      {
        "id": "CCVE-2025-3758",
        "name": "DaemonSet does not disable automountServiceAccountToken",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "DaemonSet",
          "name": "longhorn-manager",
          "namespace": "longhorn-system"
        },
        "message": "DaemonSet does not set automountServiceAccountToken: false; pods get unnecessary API credentials",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set automountServiceAccountToken to false in the pod spec",
            "Only enable for DaemonSets that genuinely need Kubernetes API access"
          ],
          "commands": [
            "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-RBAC-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set automountServiceAccountToken to false in the pod spec",
          "command": "kubectl get daemonset <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3758"
        }
      },
      {
        "id": "CCVE-2025-3765",
        "name": "Ingress has no TLS configuration",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Ingress",
          "name": "longhorn-ingress",
          "namespace": "longhorn-system"
        },
        "message": "Ingress has no TLS configuration; traffic is unencrypted",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Add spec.tls with the appropriate hosts and secretName",
            "Create a TLS Secret with the certificate and key",
            "Consider using cert-manager for automatic certificate management"
          ],
          "commands": [
            "kubectl get ingress <name> -n <namespace> -o jsonpath='{.spec.tls}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Add spec.tls with the appropriate hosts and secretName",
          "command": "kubectl get ingress <name> -n <namespace> -o jsonpath='{.spec.tls}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3765"
        }
      },
      {
        "id": "CCVE-2025-4001",
        "name": "CCVE-2025-4001",
        "category": "NETWORKING",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "unknown",
        "tool": "kubernetes",
        "resource": {
          "kind": "Service",
          "name": "longhorn-admission-webhook",
          "namespace": "longhorn-system"
        },
        "message": "Service selector matches no Deployment or StatefulSet in namespace longhorn-system",
        "remedy_type": "manual_only",
        "remedy_safety": "manual_only",
        "remediation": {
          "steps": [
            "Verify the Service selector labels match the pod template labels in target Deployment",
            "Run 'kubectl get endpoints <service-name>' to confirm endpoint list is populated"
          ],
          "commands": [
            "kubectl get endpoints <service-name> -n <namespace>"
          ]
        },
        "evidence_source": "native",
        "action_type": "human-decision",
        "next_step": {
          "action": "update_config",
          "description": "Verify the Service selector labels match the pod template labels in target Deployment",
          "command": "kubectl get endpoints <service-name> -n <namespace>",
          "doc_ref": "cub-scan --explain CCVE-2025-4001"
        }
      },
      {
        "id": "CCVE-2025-4001",
        "name": "CCVE-2025-4001",
        "category": "NETWORKING",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "unknown",
        "tool": "kubernetes",
        "resource": {
          "kind": "Service",
          "name": "longhorn-backend",
          "namespace": "longhorn-system"
        },
        "message": "Service selector matches no Deployment or StatefulSet in namespace longhorn-system",
        "remedy_type": "manual_only",
        "remedy_safety": "manual_only",
        "remediation": {
          "steps": [
            "Verify the Service selector labels match the pod template labels in target Deployment",
            "Run 'kubectl get endpoints <service-name>' to confirm endpoint list is populated"
          ],
          "commands": [
            "kubectl get endpoints <service-name> -n <namespace>"
          ]
        },
        "evidence_source": "native",
        "action_type": "human-decision",
        "next_step": {
          "action": "update_config",
          "description": "Verify the Service selector labels match the pod template labels in target Deployment",
          "command": "kubectl get endpoints <service-name> -n <namespace>",
          "doc_ref": "cub-scan --explain CCVE-2025-4001"
        }
      },
      {
        "id": "CCVE-2025-4001",
        "name": "CCVE-2025-4001",
        "category": "NETWORKING",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "unknown",
        "tool": "kubernetes",
        "resource": {
          "kind": "Service",
          "name": "longhorn-recovery-backend",
          "namespace": "longhorn-system"
        },
        "message": "Service selector matches no Deployment or StatefulSet in namespace longhorn-system",
        "remedy_type": "manual_only",
        "remedy_safety": "manual_only",
        "remediation": {
          "steps": [
            "Verify the Service selector labels match the pod template labels in target Deployment",
            "Run 'kubectl get endpoints <service-name>' to confirm endpoint list is populated"
          ],
          "commands": [
            "kubectl get endpoints <service-name> -n <namespace>"
          ]
        },
        "evidence_source": "native",
        "action_type": "human-decision",
        "next_step": {
          "action": "update_config",
          "description": "Verify the Service selector labels match the pod template labels in target Deployment",
          "command": "kubectl get endpoints <service-name> -n <namespace>",
          "doc_ref": "cub-scan --explain CCVE-2025-4001"
        }
      },
      {
        "id": "CCVE-2025-4078",
        "name": "ClusterRole grants secrets read permissions",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "ClusterRole",
          "name": "longhorn-role",
          "namespace": "default"
        },
        "message": "ClusterRole grants secrets get/list, enabling credential exfiltration across namespaces",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Remove secrets get/list permissions from ClusterRoles that do not require credential access",
            "Scope secret access to namespaced Role bindings where possible"
          ],
          "commands": [
            "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-RBAC-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Remove secrets get/list permissions from ClusterRoles that do not require credential access",
          "command": "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'",
          "doc_ref": "cub-scan --explain CCVE-2025-4078"
        }
      }
    ],
    "provenance": {
      "source": "cub-scan",
      "source_version": "v0.7.3",
      "scan_time": "2026-08-24T16:00:40Z",
      "catalog_version": "risk-catalog-v1.json@7ff79a126ad9"
    },
    "pattern_bundle": {
      "schema_version": "bundle-manifest-v1",
      "version": "v0.7.3",
      "source_repo": "confighubai/confighub-scan",
      "manifest_sha256": "0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8",
      "catalog_sha256": "7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba"
    },
    "input": {
      "object_count": 42,
      "object_set_sha256": "sha256:51b5feac61ea772e177c605e40ebe2a3014371754b646138ebde56d7a185f983"
    }
  }
}