{"slug": "suppress-vulnerabilities-applying-kubernetes-context-to-scans", "title": "Suppress vulnerabilities applying Kubernetes context to scans", "summary": "Developer alegrey91 released vex8s, an experimental open-source tool that generates VEX (Vulnerability Exploitability eXchange) documents by correlating container vulnerabilities with Kubernetes securityContext settings to determine which CVEs are actually exploitable in a cluster. Vex8s uses an embedded machine-learning model to predict each CVE's exploitation category from its description, combines that with CWE classifications, and maps the result to Kubernetes settings that can block or reduce impact, supporting passive mode via existing Trivy or Grype reports and active mode that scans images directly with those engines. The tool then emits a VEX document that scanners such as Trivy and Grype can consume to suppress non-exploitable vulnerabilities.", "body_md": "[(this logo is not AI generated)](https://github.com/alegrey91/vex8s/blob/main/vex8s.png)\n\nVex8s generates [VEX](https://www.ntia.gov/files/ntia/publications/vex_one-page_summary.pdf) documents by correlating container vulnerabilities with Kubernetes settings to determine which CVEs are actually exploitable in your cluster.\n\nPlease note, this is an experimental project. Things might change quickly.\n\nThe project aims to assess the exploitability of known CVEs within Kubernetes workloads by combining vulnerability classification and [`securityContext`](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) analysis.\n\nIt is based on the following concept:\n\n- Each CVE is categorized into one or more vulnerability classes ([CWE](https://cwe.mitre.org/index.html) )\n- CVE description is processed by an embedded ML [model](https://github.com/alegrey91/vex8s-model) to predict its[*exploitation category*](https://github.com/alegrey91/vex8s-model?tab=readme-ov-file#classification) .\n- Both the CWEs and the predicted *exploitation categories* are combined to determine if the CVE is mitigable.\n- Each *exploitation category* , maps to a set of Kubernetes settings that can block or reduce the impact.\n- By parsing a Kubernetes manifest, we can inspect the container settings to evaluate whether the relevant settings are in place.\n- Combining both analyses allows the system to determine if a CVE is exploitable in a given workload configuration.\n- If it results in a CVE mitigation, we add this to the final VEX document.\n\nFor a more in-depth reading you can consult this paper: [Environment-Aware Vulnerability Suppression Using Kubernetes Security Contexts and VEX](https://github.com/alegrey91/vex8s/blob/main/docs/environmet_aware_vulnerability_suppression_using_kubernetes_security_context_and_vex.pdf)\n\nYou can download the latest binary from the [release](https://github.com/alegrey91/vex8s/releases) page.\n\nOr you can build it manually:\n\n```\nmake build\n```\n\n`vex8s` currently supports 2 ways to generate VEX documents:\n\n- \n**passive-mode** : passing an already generated vulnerability report created by`trivy` or`grype` .\n- \n**active-mode** : actively scanning the images using`trivy` or`grype` engines and then gereating the document based on the results.\n\nUsing `trivy`:\n\n```\n# generate vulnerability report.\ntrivy image --format json --output nginx.trivy.json nginx:1.21.0\n\n# generate VEX document by processing vulnerability report.\nvex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json --output nginx.vex.json\n\n# scan again with VEX document to suppress vulnerabilities.\ntrivy image --vex nginx.vex.json --show-suppressed nginx:1.21.0\n```\n\nThe same can be applied using `grype`:\n\n```\n# generate sbom report.\ngrype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0\n\n# generate vulnerability report.\ngrype sbom:./nginx.grype.json --output json --file nginx.grype-vr.json\n\n# generate VEX document by processing vulnerability report.\nvex8s generate --manifest examples/nginx.yaml --report nginx.grype-vr.json --output nginx.vex.json\n\n# scan sbom with VEX document to suppress vulnerabilities.\ngrype sbom:./nginx.grype.json --output table --vex nginx.vex.json --show-suppressed\n```\n\nUsing `trivy`:\n\n```\n# scan the image and automatically generate VEX document.\nvex8s generate --manifest examples/nginx.yaml --scan.engine trivy --output nginx.vex.json\n\n# scan again with VEX document to suppress vulnerabilities.\ntrivy image --vex nginx.vex.json --show-suppressed nginx:1.21.0\n```\n\nThe same can be applied using `grype`:\n\n```\n# generate sbom report.\ngrype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0\n\n# scan the image and automatically generate VEX document.\nvex8s generate --manifest examples/nginx.yaml --scan.engine grype --output nginx.vex.json\n\n# scan sbom with VEX document to suppress vulnerabilities.\ngrype sbom:./nginx.grype.json --output table --vex nginx.vex.json --show-suppressed\n```\n\nEach CVE is classified into one or more *exploitation classes*, which drive the\nmitigation decision. `vex8s` supports two classifier engines via `--classifier`:\n\n- **`embedded`** (default): an offline ONNX ML[model](https://github.com/alegrey91/vex8s-model) bundled in the binary. No network access required.\n- **`gemini`** : uses Google's Gemini LLM to classify the CVE description.\nRequires the`GEMINI_API_KEY` environment variable (optionally`GEMINI_MODEL` ).\n\n```\nexport GEMINI_API_KEY=\"your-api-key\"\n\nvex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json \\\n  --output nginx.vex.json --classifier gemini\n```\n\nSee the [documentation](https://github.com/alegrey91/vex8s/blob/main/docs) — in particular the\n[User Guide](https://github.com/alegrey91/vex8s/blob/main/docs/user-guide.md) — for a full walkthrough, the Gemini\nclassifier setup, and a complete flag reference.\n\nThis project was inspired by Akihiro Suda's project [vexllm](https://github.com/AkihiroSuda/vexllm).", "url": "https://wpnews.pro/news/suppress-vulnerabilities-applying-kubernetes-context-to-scans", "canonical_source": "https://github.com/alegrey91/vex8s", "published_at": "2026-09-17 13:39:50+00:00", "updated_at": "2026-09-17 13:59:11.562211+00:00", "lang": "en", "topics": ["ai-tools", "machine-learning", "developer-tools", "ai-infrastructure"], "entities": ["vex8s", "alegrey91", "Kubernetes", "Trivy", "Grype", "CVE", "CWE", "VEX"], "alternates": {"html": "https://wpnews.pro/news/suppress-vulnerabilities-applying-kubernetes-context-to-scans", "markdown": "https://wpnews.pro/news/suppress-vulnerabilities-applying-kubernetes-context-to-scans.md", "text": "https://wpnews.pro/news/suppress-vulnerabilities-applying-kubernetes-context-to-scans.txt", "jsonld": "https://wpnews.pro/news/suppress-vulnerabilities-applying-kubernetes-context-to-scans.jsonld"}}