I've observed the following two critical vulnerabilities in release v0.2.1:

• https://avd.aquasec.com/nvd/2022/cve-2022-48174/ (busybox; busybox-binsh; ssl_client)
• https://avd.aquasec.com/nvd/2023/cve-2023-38545/ (curl; libcurl)

CVE-2022-48174 has been fixed in Alpine 3.18.4. https://alpinelinux.org/posts/Alpine-3.18.4-released.html

Alpine version from ghcr.io/kube-logging/fluentd-drain-watch:v0.2.1 is 3.18.0:

docker run --rm -ti --entrypoint=cat ghcr.io/kube-logging/fluentd-drain-watch:v0.2.1 /etc/alpine-release
3.18.0

From Dockerfile: https://github.com/kube-logging/fluentd-drain-watch/blob/main/Dockerfile#L1C1-L1C17

FROM alpine:3.18

I see to alternatives to fix this issue:

1 - Tag a new version (e.g., v0.2.2). It will pull a new Alpine 3.18, which is 3.18.5 at the time of this writting.
2 - Bump base image to 3.19.0 (note the specific image version, thus you have more visibility)

Tooling used: Trivy