clair-scanner reports vulnerabilities and fails the build in CI

By Daniel Zoghalchali·Latchkey

clair-scanner submits the image to a Clair server, then compares the returned CVEs against a whitelist YAML. Any vulnerability not on the list is "unapproved", and the scanner exits 1. The failure means the image has CVEs you have not explicitly accepted.

What this error means

clair-scanner prints per-CVE lines and ends with "Unapproved vulnerabilities" and a non-zero exit, failing the pipeline stage.

2026/06/30 10:55:12 [CRITICAL] CVE-2024-XXXX  libssl3
2026/06/30 10:55:12 [WARN] Image contains unapproved vulnerabilities: [CVE-2024-XXXX]
# clair-scanner exits with code 1

Common causes

The image has CVEs not on the whitelist

clair-scanner fails on any vulnerability absent from the --whitelist file, so new CVEs in the image trip the gate.

A stale Clair vulnerability database

If the Clair server's updater has not refreshed, results may lag reality in either direction, but the gate still acts on what Clair returns.

How to fix it

Remediate the CVE or add a reviewed whitelist entry

1. Patch the package the CVE names by bumping the base image.
2. For an accepted, unfixable CVE, add it to the whitelist YAML with a comment.
3. Re-run clair-scanner against the Clair server.

clair-scanner --ip="$RUNNER_IP" \
  --clair="http://clair:6060" \
  --whitelist=clair-whitelist.yaml myimage:latest

Keep the Clair database updated

Ensure the Clair server's updater runs so its vulnerability data is current before scans rely on it.

# clair-whitelist.yaml
generalwhitelist:
  CVE-2024-XXXX: "no upstream fix; review 2026-09-01"

How to prevent it

• Keep the Clair server database refreshed by its updater.
• Maintain a reviewed whitelist with reasons and review dates.
• Rebuild on patched bases so unapproved CVEs clear.

Frequently asked questions

Related guides

References

• GitHub Actions documentation