Skip to main content
Talos Enterprise Linux images can be scanned for vulnerabilities using the per-schematic SBOM, which describes exactly what is in your image, and Sidero-curated VEX data, which filters out CVEs that do not apply to Talos as built. Together they produce accurate scan results with fewer false positives. There are three ways to run the scan:
  • Get a scan report through Omni: If your Omni account includes a Talos Enterprise Linux entitlement, the Omni UI and omnictl can fetch scan reports directly for any running cluster.
  • Download a scan report from Enterprise Image Factory: Enterprise Image Factory runs the scan and provides a completed report.
  • Run the scan locally with Grype: You run the scan yourself using the downloaded SBOM and VEX data.

​
Prerequisites

Before you begin, make sure you have the following:
  • The SBOM and VEX data for your image. You can download both from Enterprise Image Factory using your credentials (see Download images and artifacts from Enterprise Image Factory), or through Omni — via the UI or omnictl security sbom and omnictl security vex — if your Omni account includes a Talos Enterprise Linux entitlement.
  • Grype, if you want to run the scan locally. Grype is a free, open-source vulnerability scanner that analyses an SBOM and reports known vulnerabilities in the components it contains.
The commands below assume the SBOM is saved as image.spdx.json and the VEX data as talos.vex.json.

​
Get a scan report through Omni

For Omni accounts with a Talos Enterprise Linux entitlement, you can access scan reports, SBOMs, and VEX documents directly through the Omni UI or omnictl. See Use Talos Enterprise Linux with Omni.

​
Get a scan report from Enterprise Image Factory

Enterprise Image Factory can run the scan for you and return a finished report, combining the schematic’s SBOM, the VEX data, and its vulnerability database server-side. Reports are available in several formats:
  • .json — output format of the underlying scanner
  • .table — human-readable table
  • .sarif — SARIF format, for import into code-scanning systems
  • .cdx — CycloneDX format, consumed by supply-chain platforms
For how to download a report in each format, see Download images and artifacts from Enterprise Image Factory.

​
Scan locally with Grype

Scanning locally has two variants: a basic scan against the SBOM, and the same scan with the VEX data added to filter out CVEs that do not apply to Talos. You can run either on its own.

​
Scan the SBOM

Run Grype directly against the SBOM:
Grype matches every component listed in the SBOM against its vulnerability database and reports the CVEs it finds, with severity, fixed-in version, and match details. Because the SBOM is generated per schematic, it describes your exact image — the Talos base plus every system extension in your configuration. This differs from the release SBOMs published on GitHub, which cover only the unmodified base OS. For base-OS SBOMs and reading SBOMs from a running node, see SBOMs.

​
Filter non-applicable CVEs with VEX

A raw scan includes CVEs that match a component but do not affect Talos as built. VEX (Vulnerability Exploitability eXchange) statements are Sidero’s curated, per-statement-signed declarations of which CVEs actually apply:
The result excludes findings that Sidero has assessed as not applicable to Talos as built. This reflects the same suppression applied in the Enterprise Image Factory UI, where the Schematic Ready page reports the vulnerability count “after VEX suppression.” Local and Enterprise Image Factory totals can differ, because each uses its own vulnerability database snapshot.

​
When to use each approach

All three approaches use the same three inputs — the SBOM, VEX data, and a vulnerability database — to produce a vulnerability report. The right approach depends on the tooling you have available and whether you want to run the scan locally or have it handled for you:
  • Get a server-side scan report: Enterprise Image Factory or Omni runs the scan for you, so you don’t need any local tooling or a vulnerability database. Use this when you want results quickly with no setup. You can run scans directly through Enterprise Image Factory, or through Omni (UI or omnictl security scan) if your account includes a Talos Enterprise Linux entitlement.
  • Scan locally with Grype: You run the scan on your own machine, giving you more control over where and when the scan runs. Use this when you need to run scans offline after the initial download, or when you want to integrate vulnerability scanning into your own pipeline. Download the SBOM and VEX data from Enterprise Image Factory or with omnictl security sbom and omnictl security vex, then run Grype locally.
All three approaches produce the same type of vulnerability report and use a vulnerability database that is updated independently on its own schedule.