Fail-on-severity gate blocking deploy in CI
A severity gate is supposed to block genuinely risky images, but a threshold set to MEDIUM or that counts unfixed base CVEs will fail almost every build, and teams then disable it. The fix is to gate on fixable HIGH/CRITICAL and manage the rest through an expiring allowlist, not to remove the gate.
What this error means
Every image scan fails the deploy, most findings are unfixed base-image CVEs, and there is pressure to bypass the scanner entirely to ship.
# threshold too broad: fails on unfixable medium CVEs
Total: 47 (MEDIUM: 44, HIGH: 2, CRITICAL: 1)
Error: Process completed with exit code 1. # deploy blocked on every runCommon causes
The severity threshold is set too low
Failing on MEDIUM (or lower) surfaces a flood of low-risk and unfixable findings that block every deploy.
Unfixed CVEs count toward the gate
Including vulnerabilities with no available fix means the gate blocks on things no rebuild can clear.
How to fix it
Gate on fixable HIGH/CRITICAL only
Fail on the severities you act on, and ignore unfixed so the gate blocks on remediable risk.
trivy image --ignore-unfixed \
--exit-code 1 --severity HIGH,CRITICAL myimage:latestAllowlist reviewed exceptions with an expiry
For a specific accepted CVE, add an expiring, justified allowlist entry so the gate stays on for everything else.
# .trivyignore.yaml
vulnerabilities:
- id: CVE-2024-XXXX
statement: "accepted risk; TICKET-123"
expired_at: 2026-09-01How to prevent it
- Gate on fixable HIGH/CRITICAL, not MEDIUM and below.
- Ignore unfixed so the gate blocks only actionable CVEs.
- Manage exceptions with expiring allowlist entries, not a disabled gate.