Anchore — The Cyber Toolchain

Anchore Faster Answers, Fewer False Positives with Anchore Enterprise v6.3 (2026-10-27)

Tue, 27 Oct 2026 12:00:00 GMT

Anchore Enterprise v6.3 adds quick package search, Ubuntu ESM false-positive removal, vulnerability-worsening alerts, and AI model policy gating⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Search for affected packages by name, name-plus-version, or PURL before a CVE is published — or when one never gets assigned — using the new Quick Package Search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Anchore Enterprise now fires detailed notifications when a known vulnerability's CVSS score or severity, EPSS score, or CISA KEV status changes after initial triage. • Discovered AI models (GGUF and Docker Models) are now reported as packages inside application versions, making them visible in the same inventory as other components. • Gate AI models in pipeline policy with two outcomes — Fail (hard stop) or Warn (flag for parallel vetting) — using the new packages policy gate for AI models. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore What EU CRA’s 24-hour deadline means for your SBOM (2026-09-29)

Tue, 29 Sep 2026 12:00:00 GMT

Anchore Enterprise adds EU CRA quickstart with product-lifecycle SBOM modeling, continuous KEV-gated policy evaluation, and VDR export via anchorectl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `anchorectl app add` and `anchorectl app version add` subcommands to model a product as an App and each release as a Version, enabling product-level (not scan-level) compliance tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `anchorectl app version asset add container-image-remote` and `anchorectl app version asset add sbom` subcommands to attach heterogeneous assets — direct container images or supplier-delivered SBOMs — to a versioned product release. • Adds `anchorectl app update --policy-id` and `anchorectl app version policy status get --fail-based-on-results` to attach and evaluate a CRA-focused policy (blocking on any KEV-listed finding) at the product level in CI. • Adds `anchorectl app version vex add` subcommand with `--vuln-id`, `--pkg-name`, `--pkg-type`, `--pkg-version`, `--status`, and `--action-statement` flags to record engineering VEX annotations against a specific release. • Adds `anchorectl app version export vdr` subcommand (with `-f` for output file) to generate a Vulnerability Disclosure Report bundling product identity, component inventory, and VEX analysis into a single CycloneDX document suitable for ENISA SRP submission. • Exports a unified SBOM per release version in CycloneDX and SPDX formats once all assets are attached. • Emits `policy_status_changed` notifications at the Application Version level whenever a release's compliance outcome shifts, with subscription endpoints including Webhooks, Slack, Teams, Jira, GitHub, and email. • Continuously re-evaluates every stored SBOM against updated vulnerability data and policy automatically — flagging a newly non-compliant release the moment underlying data changes, not at the next scheduled scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore FedRAMP & CMMC in 2026: what actually changed for your Authority to Operate (ATO) (2026-09-22)

Tue, 22 Sep 2026 12:00:00 GMT

Anchore Enterprise policy bundle v2026.1 adds a dedicated STOP gate for CISA KEV-listed vulnerabilities mapped to NIST 800-53 SI-2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Surfaces per-control failure detail via `anchorectl image check --detail -f`, returning the specific control and finding that failed rather than a pass/fail count, enabling assessors to trace results to a named requirement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Incorporates CISA's Known Exploited Vulnerabilities (KEV) list and EPSS exploit prediction scores alongside CVSS in the policy engine for risk-based vulnerability prioritization. • Supports POA&M enforcement through policies, gates, and time-bound allowlists, letting a non-compliant finding be allowlisted with an explicit remediation date rather than silently ignored or blocking all builds. • Extends policy enforcement from build time into live Kubernetes clusters via a runtime inventory and admission controller that blocks non-compliant workloads before scheduling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore Extending Supply Chain Security to AI Models with Anchore Enterprise v6.2 (2026-09-15)

Tue, 15 Sep 2026 12:00:00 GMT

Anchore Enterprise v6.2 adds AI/ML model SBOM detection, MCP Server for agent integration, VEX-aware policies, and local SBOM generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Natively inspects container images for AI/ML model artifacts, including `GGUF` files and Docker Model structures, indexing them as packages in the central SBOM catalog alongside traditional software components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces the Anchore Enterprise MCP Server, a lightweight container image that gives AI agents and tools direct, structured access to vulnerability findings, policy evaluation results, and SBOM catalog data without custom API integration scripts. • Adds policy support for VEX annotations, allowing policies to automatically factor in VEX status values such as `not_affected` or `fixed` to suppress false positives and prevent unnecessary build breaks. • Triggers automated notifications whenever a policy outcome changes at the application version level, alerting security teams when a previously compliant artifact becomes non-compliant. • Enables filtering of packages within an application version by associated vulnerability severity (Critical, High, Medium) to accelerate targeted remediation. • Supports local SBOM generation and output during image scanning workflows, enabling developers to inspect component inventories and compliance status before pushing artifacts to central registries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore Anchore + AI Just Got Easier: The Anchore Enterprise MCP Server (2026-09-03)

Thu, 03 Sep 2026 12:00:00 GMT

Anchore Enterprise MCP server gives AI agents native access to vulnerability findings, policy results, and SBOM data without custom glue code. • Exposes curated MCP tools covering key API properties for specific security objectives (triage, policy checks, risk reporting), with a fallback to generic API invocation for broader coverage. • Handles large payload management, pagination, and consistent response handling automatically within the MCP server, enabling agentic workflows to query Anchore at scale. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore What your SBOM inventory misses if it only covers containers (2026-08-18)

Tue, 18 Aug 2026 12:00:00 GMT

Anchore Enterprise adds VM filesystem and disk-image SBOM generation as first-class assets alongside containers • Adds `anchorectl app version asset add filesystem` subcommand with `--type virtual_machine_disk` flag to generate SBOMs from live VM filesystems or mounted disk images and attach them to an application version. • Supports scanning VM disk images offline (read-only, no agent) via QEMU NBD mount — `sudo qemu-nbd --read-only --connect=/dev/nbd0 disk.qcow2` — enabling forensic and golden-image workflows. • Skips pseudo-filesystems (`/proc`, `/sys`) by default when scanning `/`, making full-root filesystem analysis safe; narrower paths (`/usr`, `/opt`, `/srv`) are also supported for faster targeted scans. • Unifies container images (`anchorectl app version asset add container-image`), VM filesystems, and third-party SBOMs (`anchorectl app version asset add sbom`) as three asset types under one application version for cross-asset querying. • Imports and exports CycloneDX (JSON and XML) and SPDX (JSON and tag-value) formats; generated SBOMs include NTIA minimum elements: supplier name, component name, version, `purl`, dependency relationships, SBOM author, and timestamp. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.4.0

Tue, 16 Jun 2026 00:00:00 GMT

Anchore Enterprise v4.4.0 adds SPDX/CycloneDX SBOM export endpoints, Ancestry Policy Gate, and Ubuntu 22.10 feed support. • Enterprise API now supports downloading SBOMs in SPDX and CycloneDX formats via new endpoints `/images/{imageDigest}/sboms/spdx-json`, `/images/{imageDigest}/sboms/cyclonedx-json`, `/sources/{source_id}/sbom/spdx-json`, and `/sources/{source_id}/sbom/cyclonedx-json`. • New Image Ancestry Policy Gate allows verification that a specified image contains an approved base image. • Vulnerability data is now available for the Ubuntu 22.10 (Kinetic Kudu) feed group. • Configuration option `enable_package_db_load` added to disable the package.verify policy trigger and reduce database load. • AnchoreCTL binary for linux x86 is now packaged into the docker.io/anchore/enterprise image. • Tech Preview: Enterprise Reporting provides a global endpoint for queries including data from all accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.8.0

Fri, 05 Dec 2025 00:00:00 GMT

Anchore Enterprise v4.8.0 adds Kubernetes/ECS vulnerability reports, config-driven resource reduction, and UI repository toggle control • Adds `Vulnerabilities by Kubernetes Container` report template for filtering vulnerabilities within Kubernetes containers. • Adds `Vulnerabilities by ECS Containers` report template for filtering vulnerabilities within ECS containers. • Adds `ANCHORE_POLICY_ENGINE_ENABLE_IMAGES_BY_VULN_QUERY` environment variable to disable the `/v1/query/images/by_vulnerability` API and stop SBOM vulnerability rescans for resource reduction. • Adds `services.policy_engine.enable_images_by_vulnerability_api` config key in `config.yaml` for Helm deployments to control image-by-vulnerability query functionality. • Adds `enable_add_repositories` property to `config-ui.yaml` allowing suppression of Watch Repository toggles in the UI registry and repository view tables. Breaking changes: • Setting the new configuration options to false disables the `/v1/query/images/by_vulnerability` API (returning 501) and stops SBOM vulnerability rescans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 5.22.0

Fri, 28 Nov 2025 00:00:00 GMT

Anchore Enterprise v5.22.0 adds VEX annotations, direct object store access, and KEV list integration • Adds `object_store.direct_access` config key to Helm values for direct object store access from all services • Adds new `vuln-annotator-editor` RBAC role for creating and modifying vulnerability annotations • Adds VEX document generation via the `GET /v2/images/{image_digest}/vex/openvex` API endpoint • Adds KEV List flag to Policy vulnerability Gate package Trigger with a new option for known exploited vulnerabilities • Adds PURL field to vulnerability response objects in `GET /v2/images/{image_digest}/vuln/{vuln_type}`, `GET /v2/sources/{source_id}/vuln/{vuln_type}`, `POST /v2/vulnerability-scan`, and `POST /v2/scan` • Adds PURL support in Artifact Analysis UI with a dedicated column in the Contents table Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 2.0.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 2.0 adds configurable GUI dashboard, GraphQL reporting service, and LDAP integration • Adds a new configurable GUI dashboard with metrics time series for container image status • Introduces the Enterprise Reporting Service exposing full container image information via a flexible GraphQL interface • Adds LDAP/AD identity management integration with flexible RBAC account and user subsystem mappings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 2.1.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 2.1 adds SSO/SAML auth, GUI vulnerability feeds from VulnDB, and Policy Hub integration. • Adds configurable filtered reports (tabular HTML, JSON, or CSV) for image, security, and policy status in the GUI Reports control • Adds Single-Sign-On integration support for Okta, Keycloak, and Enterprise IDP systems via SAML/token-based authentication for API and client integrations • Incorporates third-party vulnerability data feeds from Risk Based Security (VulnDB) to enhance image scanning results • Enables viewing, listing, and importing pre-made policies from the Anchore Policy Hub via the Policy Hub GUI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 2.2.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 2.2 introduces notifications for GitHub/Jira/Slack/Teams, a new System Dashboard UI, and Harbor v1.10++ support • Adds Anchore Enterprise Notifications capability to send system, user, and workload level events to GitHub, Jira, Slack, and Microsoft Teams. • Adds a new System Dashboard in the Enterprise GUI to review deployment status, troubleshoot issues, and view service roles. • Adds full support for CNCF Harbor project v1.10++ as an integrated artifact registry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 2.3.1

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 2.3.1 adds relative time windows to Reporting GraphQL API and CVE blacklisting policy rules. • Adds `since` parameter to Reporting service's GraphQL API queries to specify time ranges using a relative window (e.g., 'last 30 days') instead of absolute start/end dates • Adds `licenses` field (array type) to API responses for content packages, supplementing the existing comma-delimited `license` string field Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 2.3.2

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 2.3.2 adds relative time windows to Reporting GraphQL API and CVE blacklisting in policy language • Adds support for specifying time ranges using a relative window (e.g., last 30 days) as new parameters in the Reporting service’s GraphQL API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.1.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.1.0 adds source-to-image SBOM drift detection, CVE false positive reduction feed, and image archive rules with `last_seen_in_days`. • `src2img-sbom-drift-policy-gate` and `src2img-sbom-drift-trigger` detect when source repository SBOM packages are missing from the built container image. • New `'anchore:exclusions'` vulnerability feed automatically excludes known false positives using Grype database schema Version 4. • `archival_rule_exclusion.last_seen_in_days` allows archive rules to skip images with active runtime inventory records seen within N days. Breaking changes: • Embedded Inventory Mode Feature is deprecated and will be removed in v4.2.0. • Configuration variable `ANCHORE_VULNERABILITIES_PROVIDER` is no longer supported. • Configuration variable `ANCHORE_ENTERPRISE_FEEDS_THIRD_PARTY_DRIVERS_ENABLED` is no longer supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.1.1

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.1.1 adds a Recommendation field to policy rules for remediation guidance and overhauls service logs with detailed timestamped routing info. • Adds a `Recommendation` field to Policy Rules visible in image policy check results, allowing creators to provide generic fix hints • Overhauls service log output to display detailed timestamped information categorized by level, including accessed routes, connection details, configuration details, and major runtime operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.2.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.2.0 adds SSO strict mode, node.js binary detection, and vendor-only vulnerability filtering • Adds `saml.strict_mode` config key to enforce pre-allocated SSO users for login • Adds detection of non-packaged node.js binaries during image analysis • Adds Vendor Only CVE client-side filter to the Vulnerabilities tab in the UI • Adds Kubernetes page optimized presentational view for high analytical volume via client config parameters Breaking changes: • Removed the Kubernetes Runtime Inventory Embedded mode and associated cluster configuration APIs; deploy KAI into the cluster directly in inventory mode instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.3.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.3.0 adds `runtimeInventoryUnscannedImages` report query, `repo-analyzer` RBAC role, Wolfi OS feed support, and application version vulnerability queries. • Adds the `runtimeInventoryUnscannedImages` report query to list runtime inventory images that have not been analyzed • Introduces a new `repo-analyzer` RBAC Role to create repository subscriptions as a companion to `image-analyzer` • Enables vulnerability matching for Wolfi OS Packages by importing the Wolfi Security Feed • API now supports querying a list of vulnerabilities found for a specific Application Version Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.5.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.5.0 adds report-admin RBAC role and SBOM export to Artifact Analysis. • Adds `report-admin` as a new RBAC Role for users who need to work with scheduled queries without other write permissions • Enables download of SBOM data from the Artifact Analysis view in SPDX and OWASP CycloneDX formats alongside the native JSON format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.6.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.6.0 adds a DELETE API for runtime inventory contexts and introduces an `inherit` parameter to Vulnerability Package Triggers. • Adds `/enterprise/inventories DELETE` endpoint to remove runtime inventory contexts no longer reported by KAI • Adds the `inherit` parameter to Vulnerability Package Triggers to control whether base image vulnerabilities are considered • Deprecates policy triggers using blacklist/whitelist terminology in favor of denylist/allowlist (existing entries work until policy update) • Improves Inventory Watcher logging conciseness at info level • Adds global metrics `anchore_monitor_inventory_contexts_monitored_total`, anchore_monitor_inventory_images_total (found), anchore_monitor_inventory_images_total (success), and anchore_monitor_inventory_images_total (fail) for runtime inventory monitoring • Adds analyzer status metrics: anchore_analyzer_status (waiting), anchore_analyzer_status (error), anchore_analyzer_status (processing), and `anchore_analyzer_dequeue_latency` • Improves analysis job re-queue detection time from hours to minutes when an analyzer shuts down Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.7.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise v4.7.0 adds new Runtime Inventory Agents, K8s namespace vulnerability reporting, and AnchoreCTL SBOM import. • Adds `anchore-k8s-inventory` and `anchore-ecs-inventory` as new Runtime Inventory Agents for accessing Kubernetes and ECS environments • Introduces a new "Vulnerabilities by Kubernetes Namespace" report template to filter findings by namespace • Makes the account email field editable via API endpoints • Adds a new parameter to the Vulnerability Package trigger to control behavior for base image vulnerabilities • Enables Container Image SBOM generation and import from AnchoreCTL without Syft, supporting secret scans and filesystem metadata analysis Breaking changes: • Upgrading from an Anchore Enterprise version prior to v4.2.0 requires a sequential upgrade to v4.2.0 or v4.3.0 before proceeding to v4.7.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.8.1

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise v4.8.1 adds configuration options to disable specific vulnerability reports • Adds `ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_K8S_NAMESPACE`, `ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_K8S_CONTAINER`, and `ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_ECS_CONTAINER` environment variables for Docker Compose users to control report generation • Adds `anchoreEnterpriseReports.vulnerabilitiesByK8sNamespace`, `anchoreEnterpriseReports.vulnerabilitiesByK8sContainer`, and `anchoreEnterpriseReports.vulnerabilitiesByEcsContainer` configuration keys in Helm `values.yaml` to control vulnerability reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.9.0

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.9.0 adds V2 API for migration, configurable import sizes, and new policy metadata capture. • Exposes the Anchore Enterprise V2 API as a consolidated endpoint for customers migrating from the distributed V1 APIs prior to v5.0.0 • Adds `ANCHORE_MAX_IMPORT_CONTENT_SIZE_MB` environment variable and Helm value `max_import_content_size_mb` to configure the maximum image import size (default 100 MB) • Adds `ANCHORE_MAX_IMPORT_SOURCE_SIZE_MB` environment variable and Helm value `max_source_import_size_mb` to configure the maximum source repository import size (default 100 MB) • Enables Policy Engine to capture and persist 'observed date' and 'fix observed date' for vulnerability provider sync data to support consistent max days since fix evaluations Breaking changes: • The distributed V1 API files are deprecated in favor of the consolidated V2 API; customers using direct V1 API access must migrate prior to Enterprise v5.0.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.9.2

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise v4.9.2 adds policy_action to evaluation details and fixes V2 API subscription value handling. • Evaluation Details field of Policy Evaluations will contain a `policy_action` field • `GET /v2/images/{image_digest}/check` returns both `final_action` and `policy_action` • `GET /v2/subscriptions` and `GET /v2/subscriptions/{subscription_id}` now return `repo_update` subscription_value data in V2 API format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore

Anchore 4.9.4

Mon, 30 Sep 2024 00:00:00 GMT

Anchore Enterprise 4.9.4 adds software downgrade support and fixes for Windows container analysis and feed sync • Adds the ability to execute a software downgrade from a patch release to a release within the same Major.Minor version numbers. • Fixes an issue that prevented new Windows OS containers from being analyzed properly, enabling correct reporting for these workloads. • Ensures image digests match when an image is analyzed within Enterprise (centralised analysis) versus when the SBOM is imported via AnchoreCTL (distributed analysis). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anchore