This experience showcases vulnerability analysis for container security using NVIDIA NIM microservices, NVIDIA AI-Q CVE research, and NVIDIA NeMo Agent Toolkit (NAT). The NVIDIA AI Blueprint demonstrates a multi-agent workflow that researches common vulnerabilities and exposures (CVEs) and GitHub Security Advisories (GHSAs), analyzes a target container filesystem, determines real-world exploitability, and produces a formal Vulnerability Exploitability eXchange (VEX) classification. With this blueprint, security analysts can accelerate the process of determining whether a vulnerable package is actually exploitable in a specific container context.
Patching software security issues is becoming increasingly challenging as the rate of new reports into the CVE database accelerates. Hundreds of pieces of information may need to be retrieved, understood, and mapped back to the packages, binaries, entrypoints, and runtime behavior of a single container. Clearly, the traditional approach to scanning and manually triaging every finding has become unmanageable.
Generative AI can improve vulnerability defense while decreasing the load on security teams. Using NVIDIA NIM microservices, NVIDIA AI-Q, and the NeMo Agent Toolkit, the blueprint accelerates CVE and GHSA analysis at enterprise scale by coordinating specialized agents for vulnerability research, container inspection, exploitability analysis, and VEX categorization.
The workflow expedites the manual work of a human security analyst by researching the reported vulnerability, identifying affected packages and vulnerable functions, inspecting the container root filesystem, checking package versions and security controls, tracing whether vulnerable code is reachable, and deciding whether the vulnerability is exploitable in the target environment.
After the required data is processed, the pipeline writes per-agent Markdown reports and a structured VEX JSON result. The final output includes the vulnerability identifier, container image, VEX status, justification, exploitability verdict, confidence, risk level, and links to the generated reports for review.
In this way, security analysts can cut through the noise of the increasing number of CVEs and focus on the vulnerabilities that are actually exploitable in their containerized environments.
The following are used by this blueprint:
NVIDIA NeMo Agent Toolkit (NAT), including nat run, nat serve, and nat eval
NVIDIA Nemotron 3 Ultra 550B A55B NIM (nvidia/nemotron-3-ultra-550b-a55b) for the primary agents
NVIDIA Nemotron 3.5 Lightning 30B A3B NIM (nvidia/nemotron-3.5-lightning-30b-a3b) for the CVE research subagents
NVIDIA AI-Q CVE researcher through the aiq-agent package
Tavily for web search, OSV.dev lookup, web fetch tools, and public vulnerability sources such as NVD, GitHub Advisories, and vendor advisories
crane for pulling and extracting container images
uv for Python environment management
Docker Compose deployment assets, including an nginx cache and an optional self-hosted NIM overlay
Hardware Requirements
The vulnerability analysis workflow supports the following hardware:
OS Requirements
uv for dependency managementcrane on PATH for automatic container extractionInference
NVIDIA_API_KEY)NV_BASE_URL)TAVILY_API_KEY)nvidia/nemotron-3-ultra-550b-a55b)nvidia/nemotron-3.5-lightning-30b-a3b)CVE_RESEARCHER_MODEL, CVE_SUBAGENT_MODEL, CONTAINER_ANALYZER_MODEL, EXPLOITABILITY_ANALYZER_MODEL, VEX_CATEGORIZER_MODEL, and DEFAULT_MODEL_NAMEExample Container and CVEs
Containers:
nvcr.io/nvidia/morpheus/morpheus:25.06-runtime
nvcr.io/nvidia/morpheus/morpheus-tritonserver-models:25.06
Vulnerability Alerts:
CVE-2025-47273
CVE-2026-25990
GHSA identifiers are also supported as input.
The blueprint operates as a four-agent NAT workflow named cve_pipeline. It does not include the initial container scanner that discovers vulnerabilities. Instead, it accepts CVE or GHSA identifiers from a scanner or analyst, plus a container image name and tag, then performs end-to-end analysis and VEX classification. The workflow can be run as a one-shot job with nat run, hosted as an HTTP service with nat serve, or evaluated with nat eval.
Pipeline Input and Vulnerability List
The workflow begins with a PipelineInput JSON document. It includes a list of vulnerabilities, image_name, image_tag, optional filesystem_path, optional image_config_path, and output/cache settings. Multiple CVEs can be analyzed against the same container in a single request.
Container Root Filesystem
If a filesystem path is not provided, the orchestrator combines image_name:image_tag, pulls the image with crane, extracts a flattened root filesystem, and caches it by digest for reuse. If a root filesystem has already been extracted, it can be passed directly to the workflow.
CVE Researcher
The CVE Researcher uses NVIDIA AI-Q's dedicated CVE researcher and NAT tools to query public vulnerability sources, including NVD, GitHub Advisories, OSV.dev, vendor advisories, and web pages. It produces a structured vulnerability report covering affected packages, versions, vulnerable functions or APIs, attack vectors, and remediation details.
Container Analyzer
The Container Analyzer produces a security-focused report for the target image. It runs in two isolated phases: a web research phase for public registries and vendor documentation, followed by a filesystem analysis phase for the extracted root filesystem. The analyzer classifies the container type, maps dependencies, inventories entrypoints, and records security controls. Web research can be skipped for private images.
Filesystem, Package, and Binary Tools
The workflow includes tools for reading files, listing directories, globbing, grep search, package database inspection, Python package discovery, npm and Java package discovery, shared library discovery, Go binary scanning, binary dependency extraction, distro backport checks, and security control inspection. These tools let the agents use the container filesystem as the ground truth rather than relying only on an external SBOM.
Exploitability Analyzer
The Exploitability Analyzer receives the vulnerability report and the container report. It first performs deterministic pre-triage to verify package presence, compare versions, inspect distro backports, and exit early when a vulnerability clearly does not apply. For ambiguous cases, it performs deeper LLM-based reachability and data-flow analysis within the container.
The exploitability verdicts include:
NOT APPLICABLE
ENVIRONMENT ISOLATED
NOT REACHABLE
MITIGATED
CONDITIONALLY EXPLOITABLE
EXPLOITABLE
VEX Categorizer
The VEX Categorizer reads the exploitability and container reports, follows a precedence-ordered decision flowchart, records a structured decision trace, and emits the final VEX status and justification. The VEX status is normally not_affected or affected; incomplete analyses fall back to unknown with an uncertain justification. A relaxed VEX categorization mode is available for cases where the categorizer should lean more toward code_not_reachable or requires_configuration rather than vulnerable.
The VEX justification categories include:
false_positive
code_not_present
code_not_reachable
requires_configuration
requires_dependency
requires_environment
compiler_protected
runtime_protected
perimeter_protected
mitigating_control_protected
vulnerable
At the end of the workflow run, the output includes all gathered and generated information for security analysts to review.
Note: All output should be vetted by a security analyst before being used in a cybersecurity application.
Output Reports and JSON
The pipeline writes Markdown reports for the CVE Researcher, Container Analyzer, Exploitability Analyzer, and VEX Categorizer. It also writes a VEX JSON result with fields such as cve_id, container, status, justification, reasoning, exploitability_verdict, confidence, risk_level, container_type, and report paths.
Serving, Evaluation, and Caching
The same workflow can be hosted as a FastAPI service with nat serve. The shipped configuration exposes synchronous and asynchronous workflow endpoints, including /generate, /v1/workflow/async, and /v1/workflow/async/job/{job_id}. Benchmarking is available through nat eval, including a Morpheus 25.06 benchmark dataset. Agent outputs are cached on disk by default so interrupted or repeated runs can resume without repeating expensive analysis.
NIM microservices
The NeMo Agent Toolkit workflow uses the NAT nim LLM provider and NVIDIA's OpenAI-compatible NIM APIs. NVIDIA Nemotron 3 Ultra 550B A55B (nvidia/nemotron-3-ultra-550b-a55b) powers the CVE researcher coordinator, container analyzer, exploitability analyzer, and VEX categorizer. NVIDIA Nemotron 3.5 Lightning 30B A3B (nvidia/nemotron-3.5-lightning-30b-a3b) powers the CVE research subagents. These NIMs can be overridden globally or per agent. The Docker Compose assets include an optional self-hosted NIM overlay for deployments that need local inference.
Note: Routinely checked validation datasets are critical to ensuring proper and consistent outputs.
To explore the current workflow, use the sample PipelineInput JSON and deployment notebooks in the NVIDIA AI Blueprints vulnerability-analysis repository. The example input analyzes one or more CVE/GHSA identifiers against a Morpheus 25.06 container image and writes per-agent reports plus final VEX JSON output.
By using this software or microservice, you are agreeing to the terms and conditions of the license and acceptable use policy.
GOVERNING TERMS: The NIM containers are governed by the NVIDIA Software License Agreement and Product-Specific Terms for AI Products; use of these models is governed by the NVIDIA Nemotron Open Model License Agreement.
ADDITIONAL TERMS: The selected NIM deployment and inference endpoint may be subject to their own applicable terms.
Rapidly identify and mitigate container security vulnerabilities with generative AI.