Open-source vulnerability scanners for Kubernetes: what each one does and does not do

You can get a very good picture of what is vulnerable in a Kubernetes cluster without paying anyone, and this post is about how. It covers the open-source scanners that understand Kubernetes — not just images — with equal weight on what each one does and what it leaves for you to build. Our own tools are in here with the same treatment, including the licence caveat on one of them. Everything below is as of August 2026.

What the open-source tools cover, and the gap they share

Every tool below will tell you, for one cluster, at one moment, which images contain which CVEs. Several will also generate SBOMs and audit configuration. What none of them does out of the box is the operational part: keep yesterday's answer, notice that a CVE published overnight applies to an image you already scanned, show six clusters in one list, or rank by whether a CVE is actually being exploited. Those are the things that turn a scanner into a programme, and they are where the hosted products — ours included — earn their money. Decide early whether you will build them; it changes which scanner you pick.

Trivy Operator

Trivy Operator — Aqua Security, Apache-2.0 — is the most complete in-cluster scanner. It watches workloads, scans each with Trivy as they appear, and writes the results as custom resources:

helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm install trivy-operator aqua/trivy-operator -n trivy-system --create-namespace

kubectl get vulnerabilityreports -A
kubectl get sbomreports -A
kubectl get configauditreports -A

• Does: vulnerabilities, SBOMs, config audit, exposed secrets, RBAC assessment, compliance reports (CIS, NSA) — all as CRDs, plus Prometheus metrics. Nothing leaves the cluster.
• Does not: keep history (reports carry a 24-hour TTL by default and are regenerated by rescanning), aggregate across clusters, or rank beyond CVSS. A new advisory is learnt about on the next rescan, not when it is published.
• Build yourself: a Grafana dashboard from the metrics (quick), a CRD-to-database exporter for history and fleet view (not quick).

If you run one or two clusters and want "what is vulnerable right now", stop here. We say the same on its comparison page and in the long-form post.

Kubescape

Kubescape — ARMO, Apache-2.0, a CNCF project — started as a posture scanner against the NSA/CISA hardening guidance and grew image vulnerability scanning, SBOM generation, and a runtime-based "relevancy" filter that marks which vulnerable packages are actually loaded by the running process. That last feature is genuinely distinctive.

• Does: misconfiguration scanning against several frameworks, RBAC visualisation, image CVEs, in-cluster operator with CRD results, a CLI for CI, and the relevancy filter.
• Does not: keep history or fleet view without ARMO's hosted platform, which is the commercial product. Vulnerability ranking is CVSS.

Choose it when posture is the bigger problem and vulnerabilities are second. Details on the head-to-head.

Grype and Syft

Syft generates the SBOM; Grype matches it — both Anchore, Apache-2.0. Neither knows what Kubernetes is, and that is why they are on this list: the pair is the right foundation if you intend to build the continuous part yourself. Generate one SBOM per running digest, store it, and run Grype against the stored SBOMs whenever the database updates. That is, at its core, also what StackRadar does — with Syft embedded in its scanner.

# for each running digest:
syft registry.example.com/shop/checkout@sha256:9f2c… -o cyclonedx-json > sboms/9f2c.cdx.json
# nightly, against everything stored:
grype sbom:sboms/9f2c.cdx.json -o json

• Does: the best SBOM generation available, and a solid matcher; scanning an SBOM is fast because no image is pulled.
• Does not: discover images, attribute findings to workloads, store anything, or schedule anything.

Trivy CLI (trivy k8s)

The Trivy binary can scan a whole cluster from a kubeconfig, producing a summary of vulnerabilities and misconfigurations across namespaces. It is the laptop version of the operator: same scanner, no persistence. Useful for an audit; not a replacement for the operator, because it only knows what was running when you ran it.

OSV-Scanner

OSV-Scanner — Google, Apache-2.0 — matches against OSV.dev, the aggregated open vulnerability database, and scans lockfiles, SBOMs, directories and (since 2024) container images. It is the most precise matcher on language ecosystems, because OSV records exact affected ranges rather than inferring them, and weaker on OS packages. It has no Kubernetes mode; its role here is as the engine inside the next tool.

StackRadar CLI

stackradar scan — Apache-2.0 — reads the image digests the kubelets report through your kubeconfig, scans each distinct one with the osv-scanner library, attributes findings to namespaces and pods, and flags CISA KEV entries. Table, JSON or a self-contained HTML report; --fail-on kev for a CI gate. No account, no telemetry, nothing sent to StackRadar.

• Does: the fastest honest answer to "are we running anything exploited?" on a cluster you can reach.
• Does not: persist, watch, or rank by EPSS; it inherits osv-scanner's distro-coverage limits; and it cannot pull images your laptop lacks credentials for (it says so rather than guessing).

KubeClarity (archived)

KubeClarity was, for a while, the closest open-source thing to a hosted platform: SBOM generation, multi-scanner vulnerability detection, and a dashboard, all in-cluster. It was archived in October 2024 with no migration path, and its ideas went into OpenClarity, which targets VMs and cloud assets rather than Kubernetes. If you still run it, it is no longer receiving vulnerability-database or dependency updates. Alternatives are listed here.

Adjacent tools people ask about

kube-bench and kube-hunter (Aqua) check CIS benchmark compliance and probe for cluster weaknesses; neither scans images. Falco and Tetragon are runtime detection, not vulnerability scanning. Dependency-Track (OWASP) is an SBOMstore that re-matches uploaded SBOMs continuously — it is the open-source building block for the "keep the SBOM" architecture, and pairs well with Syft and a small script that uploads one SBOM per running digest. We compare against it directly. The broader map is in Kubernetes security tools, by what they do.

Side by side

Frequently asked questions