key,summary,details,category,agent,requester_email,team,sla,priority,target_issue_key,parent_key,asset_keys,target_date,CFDRNumber,CFPOAMID,CFTypeofDR,CFCSPProvidedVulnerabilityInformation,CFRequestedRiskRatingImpact,CFAdjustedCVSSScore,CFDRSubmissionDate,CFDRRationale,CFEvidenceDescription,CFListofEvidenceAttachments,CFOperationalImpactStatement,CFVDJustification,CFListofOperationalRequirementAttachments,CFAttackVector,CFAttackVectorExplanation,CFPrivilegesRequired,CFPrivilegesRequiredExplanation,CFUserInteraction,CFUserInteractionExplanation,CFImpactMetricsConfidentiality,CFImpactMetricsConfidentialityExplanation,CFImpactMetricsIntegrity,CFImpactMetricsIntegrityExplanation,CFImpactMetricsAvailability,CFImpactMetricsAvailabilityExplanation,CFRemediationLevel,CFRemediationLevelExplanation,CFListofRiskReductionAttachments,CFAdditionalInformation,CFCVE,CFWeaknessSourceIdentifier,CFWeaknessDetectorSource
vd-fp-sg,Unrestricted management ingress,"False positive request for the security group finding. The rule exists, but the subnet network ACL denies inbound tcp/22 from outside the VPC, so no effective path exists from the internet to the management tier.",Continuous Monitoring>Misconfiguration>Network Device,Demo Account,,Continuous Monitoring,,,iss-sg-open,,,,DR-DEMO-001,,FP,,N/A,,2026-08-06,The benchmark control evaluates the security group in isolation and does not consider the network ACL applied at the subnet boundary. The effective ingress path is closed.,"Network ACL rule set for the management subnet showing an explicit deny for inbound tcp/22 from non-VPC sources, plus a reachability analyzer result showing no path from the internet gateway to the bastion on tcp/22.",nacl-management-subnet.json; reachability-analyzer-bastion-22.pdf,,,,,,,,,,,,,,,,,,,"The rule is still scheduled for removal as configuration hygiene; the deviation addresses the risk rating, not the cleanup.",,powerpipe-vpc-security-group-unrestricted-ssh,Steampipe Powerpipe
vd-ra-resshion,regreSSHion on the web tier,"Risk adjustment request for the regreSSHion finding on the web tier host. Inbound SSH is closed at both the security group and the network ACL, and administrative access is mediated by SSM Session Manager, so the attack vector is not network-reachable from outside the boundary.",Continuous Monitoring>Vulnerability>Operating System,Demo Account,,Continuous Monitoring,,,iss-resshion-web,,,,DR-DEMO-002,,RA,,PAIN3: NLEV,5.9,2026-08-06,"Exploitation requires network access to sshd. No inbound SSH path exists from outside the VPC and administrative sessions are brokered by SSM over IAM-authorized API calls, so the modified attack vector is local rather than network.",,,,,,Local (MAV:L),sshd is reachable only from within the private subnets; there is no inbound SSH path from the internet or from customer networks.,Low (MPR:L),An attacker must already hold an authorized SSM session or a foothold inside the private subnet to reach the service.,None (MUI:N),No operator action is required for the race condition to be attempted.,High (MC:H),"Successful exploitation yields root on the host, which can read application configuration.",High (MI:H),Root access permits modification of the web tier configuration.,Low (MA:L),"The tier is horizontally scaled behind the load balancer, so a single host loss degrades rather than interrupts service.",Official Fix,An upstream OpenSSH release addresses the defect and is scheduled in the September patch window.,sg-management-tier.json; ssm-session-policy.json,,CVE-2024-6387,nessus-plugin-201195,Tenable Nessus
vd-or-text4shell,Text4Shell library pinned by vendor,Operational requirement request for the Apache Commons Text finding. The affected version is pinned by an upstream dependency of the document-processing worker and cannot be upgraded independently without breaking the ingestion pipeline.,Continuous Monitoring>Vulnerability>Code,Demo Account,,Continuous Monitoring,,,iss-text4shell,,,,DR-DEMO-003,,OR,,PAIN3: NLEV,,2026-08-06,The library version is fixed by an upstream package that has not yet released a build against a patched Commons Text. Forcing the upgrade breaks document parsing for several agency file formats.,,,"Overriding the pinned dependency causes the document-processing worker to fail on PDF and legacy Office formats, which removes ingestion for the majority of agency submissions. The vendor has committed to a patched release in the next minor version.",,dependency-tree-worker.txt; vendor-roadmap-commitment.pdf,,,,,,,,,,,,,,,,"Compensating control: code review confirms no untrusted input path reaches the interpolator, and a static analysis rule now fails the build if one is introduced. Last vendor check-in 2026-08-01.",CVE-2022-42889,,Snyk
vd-orra-leakyvessels,Leaky Vessels pending AMI release,"Combined operational requirement and risk adjustment for the runc container escape. The fix ships in an AWS-managed EKS AMI that has not yet been released for the node group's Kubernetes version, and image provenance controls materially reduce exploitability.",Continuous Monitoring>Vulnerability>Container,Demo Account,,Continuous Monitoring,,,iss-leakyvessels,,,,DR-DEMO-004,,OR RA,,PAIN2: NLEV,6.8,2026-08-06,"Exploitation requires running a crafted container image. Registry immutability, image signing, and admission control restrict workloads to signed images built by the pipeline, so an attacker must first compromise the build chain.",,,The runc fix is delivered through the EKS optimized AMI. Building a custom AMI outside the managed release stream would take the node groups off the supported upgrade path and delay Kubernetes patching overall.,,eks-ami-release-notes.txt,Local (MAV:L),The attacker must already be able to schedule a container on the node group.,High (MPR:H),"Scheduling a workload requires authenticated access to the cluster and the ability to pass admission control, which only accepts signed pipeline-built images.",None (MUI:N),No operator interaction is needed once a crafted image is scheduled.,High (MC:H),Host filesystem access would expose node-level configuration.,High (MI:H),Escape permits modification of node state.,Low (MA:L),Node groups are multi-AZ and self-healing.,Unavailable,No managed AMI carrying the patched runc has been published for this Kubernetes version yet.,admission-policy.yaml; ecr-immutability-config.json,Last vendor check-in 2026-08-04; no patched managed AMI published for this Kubernetes version.,CVE-2024-21626,,Trivy
