(this logo is not AI generated)
Vex8s generates VEX documents by correlating container vulnerabilities with Kubernetes settings to determine which CVEs are actually exploitable in your cluster.
Please note, this is an experimental project. Things might change quickly.
The project aims to assess the exploitability of known CVEs within Kubernetes workloads by combining vulnerability classification and securityContext analysis.
It is based on the following concept:
- Each CVE is categorized into one or more vulnerability classes (CWE )
- CVE description is processed by an embedded ML model to predict itsexploitation category .
- Both the CWEs and the predicted exploitation categories are combined to determine if the CVE is mitigable.
- Each exploitation category , maps to a set of Kubernetes settings that can block or reduce the impact.
- By parsing a Kubernetes manifest, we can inspect the container settings to evaluate whether the relevant settings are in place.
- Combining both analyses allows the system to determine if a CVE is exploitable in a given workload configuration.
- If it results in a CVE mitigation, we add this to the final VEX document.
For a more in-depth reading you can consult this paper: Environment-Aware Vulnerability Suppression Using Kubernetes Security Contexts and VEX
You can download the latest binary from the release page.
Or you can build it manually:
make build
vex8s currently supports 2 ways to generate VEX documents:
passive-mode : passing an already generated vulnerability report created bytrivy orgrype . #
active-mode : actively scanning the images usingtrivy orgrype engines and then gereating the document based on the results.
Using trivy:
trivy image --format json --output nginx.trivy.json nginx:1.21.0
vex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json --output nginx.vex.json
trivy image --vex nginx.vex.json --show-suppressed nginx:1.21.0
The same can be applied using grype:
grype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0
grype sbom:./nginx.grype.json --output json --file nginx.grype-vr.json
vex8s generate --manifest examples/nginx.yaml --report nginx.grype-vr.json --output nginx.vex.json
grype sbom:./nginx.grype.json --output table --vex nginx.vex.json --show-suppressed
Using trivy:
vex8s generate --manifest examples/nginx.yaml --scan.engine trivy --output nginx.vex.json
trivy image --vex nginx.vex.json --show-suppressed nginx:1.21.0
The same can be applied using grype:
grype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0
vex8s generate --manifest examples/nginx.yaml --scan.engine grype --output nginx.vex.json
grype sbom:./nginx.grype.json --output table --vex nginx.vex.json --show-suppressed
Each CVE is classified into one or more exploitation classes, which drive the
mitigation decision. vex8s supports two classifier engines via --classifier:
embedded(default): an offline ONNX MLmodel bundled in the binary. No network access required.gemini: uses Google's Gemini LLM to classify the CVE description. Requires theGEMINI_API_KEYenvironment variable (optionallyGEMINI_MODEL).
export GEMINI_API_KEY="your-api-key"
vex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json \
--output nginx.vex.json --classifier gemini
See the documentation — in particular the User Guide — for a full walkthrough, the Gemini classifier setup, and a complete flag reference.
This project was inspired by Akihiro Suda's project vexllm.