Introduction

Kubewarden SBOM Scanner is an SBOM-based vulnerability scanner for Kubernetes clusters. It scans container images, image registries, running workloads, and cluster host nodes, generating a software bill of materials for each and detecting both operating-system and application-library vulnerabilities.

Kubewarden SBOM Scanner is a vendor neutral, CNCF Sandbox project, originally created by SUSE Rancher.

How does Kubewarden SBOM Scanner help?

SBOM Scanner tells you which known vulnerabilities are in your cluster, where they are, and which ones matter.

Benefits and value

  • One tool scans your registries, your running workloads, and your nodes.

  • The SBOM is the source of truth. When the vulnerability database changes, the scanner reads the stored SBOM again. It does not pull the image again.

  • Every result is a Kubernetes resource. You read it with kubectl, and your tools read it with a Kubernetes client.

  • VEX statements remove the vulnerabilities that do not apply to your images, so the reports contain less noise.

  • Platform and tag filters limit the scan to the images that you run.

  • The scanner works in an air-gapped cluster, with mirrored databases and repositories.

  • Traces and metrics go to any OpenTelemetry collector. An AI assistant can query the results through the MCP server.

  • SBOM Scanner is part of a CNCF project, with an open community.

Use cases

  • Inventory. Know which vulnerabilities are in each registry, workload, and node of the cluster.

  • Remediation. Find the workloads that use a vulnerable image, and the version that fixes it.

  • Integration. Feed the reports to dashboards, pipelines, and admission policies.

There is further documentation of use cases on the use cases page.

New to SBOM Scanner?

Start with the quick start. It installs SBOM Scanner and runs a first scan of a registry. Then read the architecture page to see how the parts fit together, and the user guide page for the scan that you need: registries, workloads, or nodes. Operators find the cluster requirements in the compatibility page, and the Helm values and the troubleshooting steps in the how-tos. Security engineers find the report fields in Querying reports and the terms in the glossary. Before you deploy to production, verify the release that you install.

What is an SBOM?

A Software Bill of Materials is a list of the packages in a piece of software, with the name and version of each package. SBOM Scanner writes each SBOM in the SPDX format. An SBOM of a container image lists the operating system packages and the application libraries in the image. An SBOM of a node lists the packages on the host file system.

Why scan SBOMs instead of images?

The content of an image changes less often than the vulnerability database. A scanner that reads the image on each scan pulls the same bytes again and again. SBOM Scanner generates the SBOM once, when it discovers the image. Each later scan matches the stored SBOM against the current database. This is fast, and it does not load the registry.

Images with the same digest share one SBOM. A tag that moves to a new digest gets a new SBOM. Because the SBOM is a Kubernetes resource, you can read it, export it, and give it to an auditor without a scan.

Vendor neutrality

SBOM Scanner is a vendor neutral project as defined by the CNCF.