Trivy exit code 1 "Total: N (HIGH: x, CRITICAL: y)" gate fail in CI

By Kaveh Alemi·Latchkey

Trivy scanned the image, printed a per-target table ending in "Total: N (HIGH: x, CRITICAL: y)", and exited 1 because you passed --exit-code 1 with a --severity that the findings matched. The gate is working as configured; the image genuinely has those CVEs.

What this error means

The Trivy step fails the job. Its log shows one or more vulnerability tables and a "Total:" line counting HIGH and CRITICAL entries, followed by a non-zero exit that stops the pipeline.

myimage:latest (debian 12.5)
============================
Total: 3 (HIGH: 2, CRITICAL: 1)

+----------+------------------+----------+-------------------+---------------+
| LIBRARY  | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |
+----------+------------------+----------+-------------------+---------------+
| libssl3  | CVE-2024-XXXX    | CRITICAL | 3.0.11-1          | 3.0.13-1      |
+----------+------------------+----------+-------------------+---------------+
Error: Process completed with exit code 1.

Common causes

The image contains CVEs at your failing severity

You ran trivy image --exit-code 1 --severity HIGH,CRITICAL, and packages in the image have fixes available at that level, so the gate fails by design.

A base-image CVE you did not introduce

Most findings come from the OS packages in the base layer, not your application code, so bumping your own dependencies does not clear them.

How to fix it

Update the packages Trivy names, then rescan

1. Read the FIXED VERSION column for each finding.
2. Bump the base image tag or run the OS updater so those packages reach the fixed version.
3. Re-run the scan to confirm the Total drops to zero at your severity.

# rebuild on a patched base, then rescan
docker build -t myimage:latest .
trivy image --exit-code 1 --severity HIGH,CRITICAL myimage:latest

Ignore only unfixable findings, with justification

For a CVE with no fixed version yet, record it in a .trivyignore with a comment and an expiry rather than dropping the whole gate. Do not suppress fixable CVEs.

# .trivyignore - review before 2026-09-01
# no upstream fix yet; tracked in TICKET-123
CVE-2024-XXXX

How to prevent it

• Pin and regularly bump the base image so OS CVEs stay patched.
• Fail on HIGH,CRITICAL but allow unfixed with a tracked allowlist.
• Run the scan on every push so new CVEs surface before release.

Frequently asked questions

Related guides

References

• GitHub Actions documentation