# Grype "discovered vulnerabilities at or above the severity threshold" in CI

> Fix Grype "discovered vulnerabilities at or above the severity threshold" in CI - the image scan found CVEs at or above the --fail-on level you set, so Grype exits non-zero.

Source: https://latchkey.dev/learn/ci-integrations/grype-above-severity-threshold-fail-in-ci  
Updated: 2026-06-30

Grype prints its findings table, then fails because you passed `--fail-on high` (or critical) and at least one matched. The message "discovered vulnerabilities at or above the severity threshold" means the gate is doing its job; the image has qualifying CVEs.

## Make the gate meaningful

- Fail the build on the severity you actually intend to block, and set it explicitly. A scanner that reports without failing is documentation, not a gate.
- Scan the artifact you ship, not the source tree. A vulnerability in a base image will not appear in a source scan.
- Pin the scanner version and its database snapshot for reproducibility, then update deliberately; a floating database turns an unrelated push into a red build.
- Give the job a way to record accepted risk, or people will disable the gate rather than triage it.

## FAQ

### What causes Grype "discovered vulnerabilities at or above the severity threshold" in CI?

There are 2 common causes: findings match your --fail-on level and unfixed base-image cves count toward the gate. You set grype myimage --fail-on high, and the image has HIGH or CRITICAL CVEs, so Grype exits non-zero as configured.

### How do I fix Grype "discovered vulnerabilities at or above the severity threshold" in CI?

There are 2 fixes depending on which cause you have: remediate the packages grype lists, then rescan and ignore only unfixed or reviewed cves. Work through them in order, since the first is the most common.

### What does Grype "discovered vulnerabilities at or above the severity threshold" in CI actually mean?

Grype lists vulnerabilities and ends with "1 error occurred ...

### How do I stop Grype "discovered vulnerabilities at or above the severity threshold" in CI happening again?

Keep the base image patched so OS CVEs stay below threshold. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt