Trivy `TEMP-*` vulnerability IDs cause the entire scan to be rejected

[HeartBtz]

Description

When importing a Trivy scan, the ingestion worker rejects the entire scan if it encounters a vulnerability whose VulnerabilityID starts with TEMP-.

The validation in app/schemas/scan_envelope.py currently only accepts CVE-* and GHSA-* identifiers:

@field_validator("vulnerability_id")
@classmethod
def _validate_vuln_id(cls, v: str) -> str:
    if not _CVE_ID_RE.match(v) and not _GHSA_ID_RE.match(v):
        raise ValueError(
            "VulnerabilityID muss CVE-YYYY-NNNN oder GHSA-xxxx-xxxx-xxxx sein"
        )
    return v

However, recent versions of Trivy (tested with v0.71.0) can legitimately emit temporary identifiers such as TEMP-* when no official CVE or GHSA identifier exists yet.

Environment

• Fathometer: latest main
• Trivy: 0.71.0
• Debian 13 (Trixie)
• Agent installed using the official installer

Steps to reproduce

1. Install the Fathometer agent.
2. Run a scan on a host where Trivy reports a vulnerability with a TEMP-* identifier.
3. The upload is accepted by the API (202 Accepted).
4. The ingestion worker processes the job.
5. Validation fails and the entire scan is discarded.

Worker logs

scan_ingest_worker.processing job_id=3 server_id=3 attempts=1

scan_ingest_worker.validation_error

scan.Results.0.Vulnerabilities.36.VulnerabilityID

Value error, VulnerabilityID muss CVE-YYYY-NNNN oder GHSA-xxxx-xxxx-xxxx sein

input_value='TEMP-...'

Agent output

The agent successfully uploads the report:

[fathometer-agent] Scan accepted (job_id=3)

This indicates that the upload itself succeeds and the failure only occurs during asynchronous ingestion.

Result

The server page displays:

The most recent scan upload was rejected (validation error).

No findings are imported, even though only a single vulnerability entry is rejected.

Expected behavior

A Trivy report containing TEMP-* vulnerability identifiers should not cause the entire scan to fail.

Possible approaches could include:

• Accepting TEMP-* identifiers during validation.
• Ignoring unsupported vulnerability identifiers while importing the rest of the report.
• Skipping only the offending vulnerability instead of rejecting the complete scan.

Rejecting an entire scan because of a single unsupported vulnerability identifier results in all valid findings being lost.