Fixed and Known Issues in 34.xx

The following table lists the fixed issues for 34.xx releases.

Fixed Issues

ISSUE ID	DESCRIPTION
PSIRT — Access Control on Delete Defender API 34.05.157	The DELETE /api/v1/defenders/{id} endpoint now validates that the target defender belongs to the caller's assigned account group, which prevents access keys with Defender Management role and Account-Group restrictions from deleting out-of-scope defenders. See pan.dev.
API Key bypassed UI-login restriction 34.05.157	Access keys are no longer able to authenticate to the Console UI when the core-block-user-direct-login-enabled policy is intended to block them. Validation of external tokens (saasAuthenticator.Authenticate → authenticateToken) strips the accessUI permission bit for access-key logins.
CNNF | rules set even if the feature is disabled 34.05.157	Regression from CWP-64459 (Quinn Update 4) that caused Twistlock iptables rules (TWISTLOCK-NET-PRE, TWISTLOCK-NET-POST) to be programmed even when CNNF was disabled. The firewall update path is now gated so no rules are added when CNNF is off.
WAAS — defender memory forced to 4 GB after rule enabled 34.05.157	After enabling a WAAS rule on a cluster, the defender's max memory limit was forced to 4 GB. This is fixed and the defender no longer decreases memory below an already-configured value.
App-embedded | defender failed to run httpd with FILESYSTEM_MONITORING turned on 34.05.157	The app-embedded defender now runs httpd-based applications correctly when the FILESYSTEM_MONITORING capability is enabled. Previously the combination caused httpd to fail to start.
Container defender — unhealthy state due to missing awk 34.05.157	On RHEL 9 hosts running the container defender, defender_health_check.sh failed with awk: command not found starting in Quinn Update 4 (34.04.145/146), causing the container to report unhealthy. The health check no longer depends on awk.
Defender CRI client initialization stuck in infinite loop after node reboot 34.05.157	On CRI-type environments (containerd / CRI-O), if the defender started before the container runtime finished initializing (typical after a node reboot on RKE2), it would loop forever with failed to initialize CRI client: runtime version cannot be determined. CRI-socket discovery now re-runs on every retry, so the defender recovers automatically once the runtime is available.
Defender | Windows/containerd | getImageByName fails for multi-arch images 34.05.157	Windows containerd manifest-list resolution now matches on major.minor.build OS version (and falls back to the closest Windows arch+os entry) instead of requiring an exact OSVersion prefix match. This resolves failed to resolve image mcr.microsoft.com/oss/v2/kubernetes/pause:3.10.1 on Windows Server 2022 (build 20348) nodes.
Defender | Windows/containerd | One unresolvable image emptied Compliance > Containers 34.05.157	On Windows containerd nodes, a single container whose image failed to resolve caused ListContainers to abort and report zero containers everywhere in the UI. The defender now logs and skips the offending container, so the rest of the inventory is reported.
AKS windows defender — error status and partial results 34.05.157	On AKS Windows Server 2022 nodes, the defender showed an error status, and only a subset of running containers appeared in runtime models, image scan results, and compliance. This was caused by the same image-resolution issue as CWP-64904 and CWP-64905 and is fixed alongside those tickets.
runc | replaceProxyRuncBinary | runc.tw may be corrupted 34.05.157	When creating /var/lib/twistlock/bin/runc.tw, the defender now uses a "safe copy" pattern (write to a temp path, then rename) and skips the copy entirely when the binary is unchanged (same hash and size). This prevents a corrupt runc.tw from being left behind if the copy is interrupted during startup or a Block-policy switch.
FP on RHEL EUS images — EUS content sets dropped by findRhelContentSets() 34.05.157	On RHEL EUS images with multiple content-set manifests, findRhelContentSets() returned an empty set because of a strict > comparison on image_layer_index when both manifests had index 0. As a result, fixes shipped via EUS advisories (for example, pam-1.5.1-24.el9_4.1 from RHSA-2025:15102) were reported as unfixed against the non-EUS fix version. The comparison is corrected, and the EUS content set is now honored.
Intelligence — CVE description DB insert failures 34.05.157	The Intelligence pipeline no longer fails to insert CVE descriptions into the database, so descriptions in the Console reflect the latest feed content.
Duplicate jar/go vulnerabilities when package keys collide 34.05.157	Fixed a regression from CWP-64606 (Quinn Update 4) in which jar and Go CVEs mapped to multiple package keys were no longer deduplicated at load time, producing duplicate CVE rows in scan results. Load-time deduplication is restored while the CWP-64606 performance gains are preserved.
Intelligence builder — repeated CVE-validation logs suppressed 34.05.157	The Intelligence builder now suppresses repeated CVE-validation log entries, so recurring vendor-feed issues no longer flood the log.
Intelligence | staging | on-prem — unexpected error connecting to IS 34.05.157	Fixed the on-prem Intelligence Stream error: unexpected intelligence error connection to Intelligence Stream failed returned by /api/v1/statuses/intelligence (with connected: false) after a manual auxiliary-identifiers upload.
Agentless-AWS — on-demand fallback on spot capacity errors 34.05.157	Agentless AWS now correctly falls back to on-demand instances when AWS returns InsufficientInstanceCapacity for spot requests, not only when it returns MaxSpotInstanceCountExceeded or "no spot capacity". This aligns behavior with the Agentless documentation.
Agentless — scans stuck in loop after subscription disabled 34.05.157	If the Console was restarted mid-scan and the customer then disabled the Agentless subscription, account statuses became stuck in cleanup and the UI continued to show an ongoing scan. Account statuses are now reset after the post-restart cleanup when no new scan is initiated.
Misconfigured cloud accounts causing scan halt 34.05.157	Misconfigured cloud accounts in the Agentless orchestrator no longer cause the entire scan cycle to halt.
Defender — Python 3.10+ version detection for dynamically loaded interpreters 34.05.157	The defender now correctly detects Python 3.10.x and later versions when the interpreter is dynamically loaded from libpython3.10.so.1.0 (or similar), instead of misreporting version 1.2.8 from an unrelated libpython string match.
Red Hat VEX — CVEs with "known_affected" and "Fix deferred" reported correctly 34.05.157	Red Hat CVEs derived from a known_affected product with none_available category and "Fix deferred" details are now reported with status "fix deferred" instead of "affected". The conditions field is preserved as *.
Flaky TestServerDefender — nil pointer dereference in socketConn.close() during upgrade 34.05.157	Fixed a nil-pointer dereference in socketConn.close() during defender upgrade (when fsmon had not yet connected to the event socket) by adding an explicit UnixConn nil check.
controller_filesystem | Healthcheck isn't set for process events 34.05.157	Process events fired by the filesystem controller now populate the Healthcheck field on ProcNotifyEvent, so container Healthcheck processes are not blocked by a runtime Prevent rule.
Vulnerabilities | Remove libnghttp2 34.05.157	The unused libnghttp2 package is removed from the defender base image to eliminate a source of recurring vulnerabilities. The defender uses Go's HTTP stack directly.
Address CVEs in PCC 34.05.157	Console vulnerability cleanup — upstream modules are upgraded to remediate outstanding CVEs in the PCC image.
Daemonset — Warning in defender yaml about deprecated "apparmor" 34.05.157	The daemonset YAML no longer emits the spec.template.metadata.annotations[container.apparmor.security.beta.kubernetes.io/twistlock-defender]: deprecated since v1.30; use the "appArmorProfile" field instead warning when applied on Kubernetes v1.30+.
OS Bundle Package No Longer Overwrites App Version 34.04.160	Fixed the scanner to prevent OS bundle packages from overwriting the application version during correlateOSPackages. This resolves incorrect vulnerability matches that occurred when OS package metadata incorrectly replaced application version information.
SQLite Read-Only Filesystem No Longer Causes Extraction Failure 34.04.160	Fixed an issue where a read-only SQLite filesystem caused OS package extraction to fail during image scanning. The scanner now handles read-only filesystem conditions correctly.
Disabled AWS Regions me-south-1 and me-central-1 to Prevent STS Timeouts 34.04.160	Disabled the me-south-1 and me-central-1 AWS regions to prevent STS authentication timeouts that affected serverless scanning operations.
Image Scanner Cleans Up Extracted JAR Files 34.04.160	Fixed the image scanner to delete extracted JAR files immediately after inspection and clean up stale JAR directories on startup. This prevents disk space exhaustion caused by accumulated temporary files.
Defender Connectivity Issue Resolved 34.04.156	Resolved a regression in Quinn update 34.04.145 that makes the Defender set iptables/nftables entries in your environment, even when there is no policy such as Cloud Native Network Security (CNNS) or DNS monitoring requesting it. This bug affects all 34.04 Defenders. If the Defender is deployed on Tanzu Application Service (TAS), this may lead to severe connectivity issues. The referenced hotfix addresses this issue and ensures that iptables/nftables rules are set only when it is explicitly reflected in the policy.
Resolved Issues 34.04.156	Additional Fixes & Improvements: Improved Startup Reliability: This fix addresses an issue where the Defender may appear not to initialize properly in CRI environments, with logs indicating: Failed to initialize CRI client: runtime version cannot be determined. Expanded Compliance Support: Added support for nftables in Compliance checks. Health Reporting Accuracy: Fixed a bug where the Defender incorrectly reported an "unhealthy" status when operating normally.
CWP-64752 34.04.156	Fixed false-positive vulnerability matches for third-party packages Fixed scanner to stop incorrectly deriving correlated OS package versions for all third-party package types, preventing false-positive vulnerability matches.
CWP-64741 34.04.156	Fixed AVA scan result corruption Fixed an issue where trailing output after an AVA (sub) process scan could corrupt scan results.
CWP-64729 34.04.156	CNNF rules applied only when enabled Fixed Cloud Native Network Firewall to only apply rules when the feature is explicitly enabled, preventing unintended network enforcement.
CWP-64712 34.04.156	Fixed container Defender status command Fixed the container Defender status command output.
CWP-64122 34.04.156	Improved gzip file detection Fixed tarball/gzip detection to use magic bytes rather than relying solely on file extension, resolving scan failures for misnamed archives.
CWP-64647 34.04.156	Fixed Windows vulnerability assessments Fixed incorrect FixedBuild mapping across Windows product IDs in the intelligence builder, resolving inaccurate Windows vulnerability assessments.
CWP-64675 34.04.156	Execute yum as root for RPM database access Fixed image augmentation to execute yum commands as root when accessing RPM databases via SQLite, resolving scan failures on certain container images.
CWP-64702 34.04.156	Fixed crash in compressed layer verification Fixed a potential crash caused by an array index out of bounds when verifying compressed layer timestamps during image scanning.
CWP-64581 34.04.145	Resolved rare kernel panic in runtime monitoring Fixed a race condition in fsmon that could lead to a kernel panic.
CWP-64543 34.04.145	Fixed WAAS rule forcing defender memory to 4GB WAAS rule no longer forces defender max memory to 4GB when enabled on a cluster.
CWP-64542 34.04.145	Fixed defender memory settings preservation Defender memory settings are now preserved correctly and no longer decrease unexpectedly.
CWP-64538 34.04.145	Fixed SSH host activity detection on Debian 13 SSH host activity is now properly detected on Debian 13 systems.
CWP-64513 34.04.145	Improved version detection accuracy for vulnerability assessment Defender and twistcli now correctly use OS package version when an app is correlated but its version is missing.
CWP-64494 34.04.145	Reduced false positive CVEs from RPM Epoch detection Fixed possible false positive CVE-2023-47038 due to RPM Epoch detection issues.
CWP-64486 34.04.145	Fixed container data display in image tab for agentless scans Container data now displays correctly in the image tab when using agentless scanning.
CWP-64467 34.04.145	Resolved yum hang during agentless scanning Fixed an issue where the yum command would get stuck during agentless scanning.
CWP-64464 34.04.145	Fixed OCI agentless connectivity in Ashburn region Resolved agentless connectivity issues for OCI in the Ashburn region.
CWP-64458 34.04.145	Improved busybox version detection in agentless scans Agentless scanning now correctly detects the full busybox version on hosts.
CWP-64454 34.04.145	Multiple defender stability improvements Backlog bug fixes for defender stability in Quinn Update 4.
CWP-64425 34.04.145	Fixed app-embedded defender exit on DNS resolution failures App-embedded defender no longer exits when handleGetAddrInfoEvent fails.
CWP-64402 34.04.145	Fixed 502 bad gateway error in Runtime Security Module Resolved a Runtime Security connectivity issue.
CWP-64398 34.04.145	Fixed image cleanup skipping images with empty hosts Image cleanup logic no longer skips images when the hosts field is empty.
CWP-64382 34.04.145	Fixed RHEL 10 defender false iptables error logging Host defender using nftables on RHEL 10 no longer logs errors about missing iptables.
CWP-64380 34.04.145	Fixed Cloud Run functions appearing in Radar when feature flag is off Functions created with gcloud run are no longer listed in Radar view when the feature flag is disabled.
CWP-64367 34.04.145	Fixed ServiceNow alert integration reliability Resolved issues with alerts failing to send to ServiceNow.
CWP-64359 34.04.145	Fixed CNNS container summary count mismatch CNNS for containers now correctly sums up to match its detail counts.
CWP-64358 34.04.145	Fixed incident audit CSV serial number column The twistlock_incidents_audit CSV file serial number column now increments correctly instead of showing constant #0.
CWP-64319 34.04.145	Fixed registry scan handling of long image tags Registry scan image cleanup no longer fails when tag exceeds 128-character limit.
CWP-64237 34.04.145	Fixed consistent WAAS protection for Istio traffic Istio traffic is now consistently protected by defender when using WAAS.
CWP-64233 34.04.145	Fixed registry scanner error message formatting Registry scanner log now shows proper image pull error messages instead of %!s(MISSING).
CWP-64167 34.04.145	Resolved log flooding from missing container images Fixed "Failed to find image for container" messages flooding the log.
CWP-64117 34.04.145	Fixed ECS EXTERNAL launch type handling Cloud Discovery now correctly handles ECS EXTERNAL launch type.
CWP-64116 34.04.145	Fixed auto-defend rules custom role filtering Host and serverless auto-defend rules are now properly filtered by custom role.
CWP-64068 34.04.145	Fixed agentless scan status persistence after refresh Agentless last scan field no longer disappears on page refresh.
CWP-64402 34.04.145	Fixed 502 bad gateway error in Runtime Security Module Resolved a Runtime Security connectivity issue.
CWP-64398 34.04.145	Image cleanup logic skips images when hosts field is empty Fixed an issue where images that have been deleted from their namespaces are still being shown in the console.
CWP-64117 34.04.145	Cloud Discovery limitation resolved ECS task definition containers with launchType: External that are listed in the Inventory are not present in the Prisma Cloud Console ( Runtime Security > Radar). This issue is now fixed.
CWP-63717 34.04.145	Filepaths of secrets found by scanners other than agentless contain prefix of scan directory Resolved an issue with the Vulnerability scan report for registry images showing vulnerabilities that are tagged to an image path which does not actually exist on the image.
CWP-64258 34.04.145	Cloud Radar resource reporting Fixed an issue with the inaccurate reporting for Defended resources.
CWP-64116 34.04.145	Console - host and serverless auto-defend rules are not filtered by custom role Resolved an issue with a custom role user not being able to access certain specifications when working with Defender Auto-Deploy rules.
CWP-64265 34.04.145	Macro fields not populated Fixed an issue with some macro fields not being populated, when a Compliance trigger is set up to forward alerts via Webhook to Service Now.
CWP-64459 34.04.145	NF table support Following the addition of NF tables support in WAAS, NF tables support is also now available for Defender (CNNF and Runtime Policy). Note: Open issues relating to the Compliance scan flow, will be addressed in a subsequent release.
CWP-64543 34.04.145	Defender Memory Settings This fix prevents memory decrease if it is already set.
CWP-63255 34.04.145	Unused Defender packages Removed multiple unused packages to reduce exposure to CVEs.
CWP-64867 34.03.138	RPM database patch Added a sqlite3 patch for RPM database (rpmdb) to address package metadata extraction issues in RPM-based images.
PCSUP-29054 34.03.138	Standardized Non-Privileged User ID for Defender CLI To enhance security across all supported operating systems, the Defender component will now use the standardized, non-privileged User ID (1100) when executing Command Line Interface (CLI) commands.
CWP-63569 34.03.138	Account-level reporting of scan date and time The scan start and end date and time were earlier reported at the region level and weren’t precise in some situations. This fix ensures accurate reporting of scan start and end date and time at the individual account level.
CWP-63632 34.03.138	Release name for Windows Server 2025 doesn’t resolve correctly This issue is fixed now. The release name for Windows Server 2025 displays correctly.
CWP-64185 34.03.138	Improved defender stability with Read-only 'runc' paths Previously, in crio environments, if the paths to runc were located in read-only directories, the defender would delegate the calls to the first runtime it found, increasing the risk of node instability. This issue has now been resolved, and defender will use the default runtime. To properly deploy the newer version containing this fix, follow these steps: Remove the existing defender daemonset. Ensure that no ZZ-twistlock.conf file is present in /etc/crio/crio.conf.d. If it exists, delete it. Restart the affected node. Deploy the new defender.
CWP-64196 34.03.138	App-embedded Defender crashes on thread termination The App-embedded defender crashes if the application it is protecting, or a thread of the application, terminates while it is connecting to the app-embedded defender.
CWP-61530 34.02.133	False positives for Oracle images and hosts The issue with CVE matching for Oracle images and hosts, which caused false positives due to missing Oracle module information, is fixed now.
CWP-63043 34.02.133	False positives for OpenShift images False positives were reported for OpenShift images due to incorrect parsing of the release label. This issue is fixed now.
CWP-63194 34.02.133	False positives due to incorrect Red Hat version comparison Added support for the epoch prefix in Red Hat images. Previously, the epoch was omitted during image scanning, causing version comparisons to ignore it and resulting in false positives. This fix ensures the epoch value is included, allowing accurate version comparisons and preventing incorrect vulnerability matches.
CWP-63341 34.02.133	Defender periodic scans are not disabled when the scan interval is set to 0 Even when the scan interval for images, containers and hosts is set to 0 on the Manage > System > Scan page in the UI, the defender continues to execute periodic scans every 24 hours. This issue is fixed now.
CWP-63479 34.02.133	Incorrect value in the CaaS containers column The value in the CaaS containers column in the Registry images table on the Monitor > Vulnerabilities > Image > Registries page was not updated if the Fargate task was no longer available in Prisma Cloud. This issue is fixed now.
CWP-63695 34.02.133	Serverless scanning of Python packages in the requirements.txt file Previously, dependencies in the requirements.txt file were not considered during vulnerability and compliance scans of Azure serverless functions and GCP Cloud Run functions for Python. Now, packages specified in requirements.txt are also included in the scan. Note that for packages in the file to be taken into consideration, specific package versions need to be specified using "==". For example: docopt == 0.6.1
CWP-63711 34.02.133	URLs for RHEL repos The issue with CVE matching that caused false positives when relative URLs for Red Hat repositories are used is fixed now.
CWP-63808 34.02.133	Gateway timeout while loading feeds Feed changed notifications to Defenders are now batched and spread to prevent 504 Gateway Timeout errors from concurrent downloads. Defenders also use Exponential Backoff with Jitter for retries.
CWP-63880 34.02.133	Base image history tagging Scanning over 50 digests under one rule caused older base image digests to be deleted, removing base image links. The Base Image tag incorrectly remained under the Layers tab for these images. This has been fixed: the Base Image tag is now correctly removed from the Layers tab for images whose original base images were overridden.
CWP-63887 34.02.133	False positives for Amazon ALAS CVE advisories False positives were generated because of the change in the URL for the Amazon ALAS CVE advisory file. The underlying cause for these false positives is fixed now.
CWP-63924 34.02.133	Node crashes on OpenShift 4.18 clusters Node crashes may happen on OpenShift 4.18 clusters in case the defender is configured with a block policy. This happens because OpenShift 4.18 has changed the default runtime implementation from runc to crun, and the defender didn’t handle that change correctly. The issue is fixed now.
CWP-63935 34.02.133	JWT tokens with Japanese characters fail to authenticate Prisma Cloud roles with names that included Japanese characters caused an error. This issue has been fixed.
CWP-63359 34.01.126	#IngressNightmare vulnerabilities This issue is fixed now. An enhanced mechanism for identification of packages helps in improved detection of vulnerabilities, such as the #ingressnightmare vulnerability issue. This enhancement allows for earlier detection and remediation, proactively mitigating potential exploits.
CWP-63421 34.01.126	The "defended" status for ECS task definitions inocorrectly set to false ECS task definition entities discovered as part of cloud discovery have a "defended" status. This "defended" status field is set to true if a Fargate defender is detected as installed in one of the containers in the task definition. This "defended" status field was incorrectly set to false even when a Fargate defender was installed in one of the containers. This issue is fixed now.
CWP-62961 Fixed in 34.00.137	Namespace associations for an image are not refreshed When an image that is associated with multiple Kubernetes namespaces is removed from one of the namespaces, the namespace associations for the image are not refreshed and the image continues to list the namespace from which it was removed. This issue is fixed for on-premise deployments now. To enable this fix, you need to: Edit the twistlock.cfg file and set the CLEAN_STALE_NAMESPACES flag to true. Restart the console. By default, the flag CLEAN_STALE_NAMESPACES is set to false. When you enable this flag and restart the console, namespaces associated with images are refreshed every 12 hours.
CWP-59903 Fixed in 34.00.137	Cleanup of system resources after registry scanning A new scanner tag is generated when an image is pulled for scanning. In certain cases, this tag was not properly removed after the scan completed. This issue is fixed now. Improvements to the registry scan mechanism ensure a proper cleanup of system resources after scanning.
CWP-60416 Fixed in 34.00.137	Incorrect parsing of Ruby advisories that use RC versions Incorrect parsing of Ruby advisories that use RC versions (such as '3.0.0-rc.1') caused false positive CVE reporting. This issue is fixed now.
CWP-61862 Fixed in 34.00.137	An incorrect fix date is reported for CVEs that did not provide a fix date initially An incorrect fix date is reported for CVEs that did not provide a fix date initially and were then reopened and fixed (again) with a fix date that is later than the date when the issue was first reported as fixed. Prisma Cloud reported the date when the issue was first reported as fixed and did not update the fix date after the issue was reopened and fixed with a different date. This issue is fixed now.
CWP-62128 Fixed in 34.00.137	Changes in the Ubuntu feed caused false positives in some situations Changes in the Ubuntu feed format added an asterisk in the condition for some CVE entries. This was not parsed correctly and led to false positives. This issue is fixed now.
CWP-62193 Fixed in 34.00.137	Incorrect fixed version reported for some CVEs reported in NVD An issue with the parsing of NVD data led to an incorrect fixed version being reported in some cases. This issue is fixed now.
CWP-62290 Fixed in 34.00.137	Fixed Debian issues that have a CVE with the "nodsa_reason" property set to "ignored" are reported as a vulnerability Debian CVEs that have an Urgency of "unimportant" or a "nodsa_reason" setting of "ignored" in the Debian feed were not reported as vulnerabilities when detected by Prisma Cloud Compute. This issue is fixed now. Now, such CVEs will be reported as vulnerabilities with the status 'will not fix' by Prisma Cloud Compute.
CWP-62394 Fixed in 34.00.137	In a few situations serverless credits were consumed even after disabling the serverless functionality In setups/tenants that had a particular (core-serverless-scan-concurrent-flow-enabled) setting enabled, serverless scan results were not deleted. This caused some serverless credits to be consumed even after the serverless feature was disabled in the tenant. This issue is fixed now.
CWP-62552 Fixed in 34.00.137	Defender is unable to identify the OpenShift installation on the OpenShift nodes The OpenShift version is not available in the RELEASE_VERSION environment variable in the running 'openshift-tuned' process due to a change in OpenShift. It has now been replaced by a new process called cluster-node-tuning-operator that receives 'openshift-tuned' via command line args. Defenders were unable to detect the OpenShift installation due to this change. This issue is fixed now.
CWP-62562 Fixed in 34.00.137	Fixed RHEL issues are incorrectly flagged as unresolved due to an issue in mapping CPEs to RHEL repositories After Redhat switched to the new VEX format for reporting CVEs and fixes, some fixed RHEL issues were incorrectly flagged as unresolved due to an issue in mapping CPEs to RHEL repositories. This issue is fixed now.
CWP-62570 Fixed in 34.00.137	Base images when scanned separately displayed vulnerabilities that were not present The scan results for some base images that were scanned separately incorrectly displayed vulnerabilities–even though no vulnerabilities were present in those base images. Whereas, images using those base images reported the vulnerabilities correctly and did not display any vulnerabilities for the underlying base images. This issue is fixed now.
CWP-62575 Fixed in 34.00.137	False positives observed for vulnerabilities reported in the RedHat VEX format without specific distro-release information Vulnerabilities reported in the RedHat VEX format without specific distro-release information generated false positives. This issue is fixed now.
CWP-62590 Fixed in 34.00.137	Prisma Cloud reported incorrect fix dates for RedHat vulnerabilities This issue occurred for vulnerabilities reported as fixed through RedHat feeds in the VEX format. This issue is fixed now.
CWP-62609 Fixed in 34.00.137	Including packages of a Go application that are part of the main module in the scan results Previously, Prisma Cloud scan results did not include Go packages that were part of the main module, resulting in the omission of these packages and their associated vulnerabilities in the console. This issue has now been resolved.
CWP-62668 Fixed in 34.00.137	Compliance check 598 always fails for Kubernetes containers running Redis if the container was created without using –requirepass parameter Compliance check 598 fails and shows the error “App uses weak or default password” for Kubernetes containers running redis even though the container uses a strong password. This issue occurs if the container was created without using –requirepass parameter. This issue is fixed now.
CWP-62883 Fixed in 34.00.137	The 'fix status' column in the vulnerability report is blank for a few CVEs The 'fix status' column in the vulnerability report is blank for a few CVEs due to missing information in the NVD vulnerability feed. This issue is fixed now. The required information is now gathered using a separate NVD function.
CWP-62884 Fixed in 34.00.137	Stale unpaired cloud security agents (CSAs) are not deleted This issue is fixed now.
CWP-62994 Fixed in 34.00.137	Container protected by an App embedded defender with File System monitoring enabled crashes when an SSH connection is made to it Container protected by an App embedded defender with File System monitoring enabled crashes when an SSH connection is made to it. This issue is fixed now.
CWP-63032 Fixed in 34.00.137	Support Jenkins LTS CVEs detection Prisma Cloud now extracts software edition information from CVEs and utilizes it for scanning. This enables Prisma Cloud scanners to differentiate software editions, such as Jenkins LTS releases from regular Jenkins releases, and accurately identify vulnerabilities.
CWP-63033 Fixed in 34.00.137	Improved Vulnerability Reporting for Mirrored RHEL Repositories Repository identifiers often change when repositories are mirrored from Red Hat’s Content Delivery Network (CDN) to alternative cloud environments, like AWS. This may result in inaccurate vulnerability reporting. The issue has now been resolved by extracting the relative URLs of repositories from the image and comparing them with the corresponding relative URLs provided in the repository-to-CPE mapping file for CVE matching.
CWP-63110 Fixed in 34.00.137	Incorrect data is returned when Prisma Cloud roles that have read only access to Windows hosts try to access and retrieve data from those Windows hosts Incorrect data is returned when Prisma Cloud roles that have read only access to Windows hosts try to access and retrieve cloud metadata from those Windows hosts. This issue is fixed now.

Known Issues

The following table lists the known issues for the 34.00 release.

ISSUE ID	DESCRIPTION
Ava — Image scan opens binary for write and blocks other processes	During image scanning, AVA may open a binary for write and hold the file open, which causes other processes (for example, LTEE) to fail launching with Text file busy. Under investigation.
QA validation for CWP-64703	The Defender serverless Java package-dependency change from CWP-64703 was merged to master and Update 4 before formal QA sign-off. Full QA validation is scheduled.
Rhel10 — Some containers get "base layer OS not supported" in Agentless scanning	Agentless scanning of certain RHEL 10 UBI-based images (for example, registry.redhat.io/rhel10/rtla:10.0-1760386166, registry.redhat.io/ubi10/ubi:10.0-1755007654) fails with "base layer OS not supported", although defender-based scans of the same images succeed. Fix targeted for a later release.
VM image scan — Error when trying to scan VM images in Azure Gov Cloud	Azure VM image scans in Azure Government use management.azure.com instead of the Azure Government endpoint, which produces SubscriptionNotFound errors. Fix pending.
Jenkins plugin — Missing console output in pipeline job	Pipeline jobs using the Prisma Cloud Compute Jenkins plugin (34.01.119) on Linux Jenkins 2.504.1 succeed and produce scan results in the Console, but the pipeline build console output is empty. Freestyle Docker jobs and Windows Jenkins pipeline jobs are unaffected.
CSA windows — No metadata details in Manage defenders page	Cloud metadata for Windows Cortex Security Agents (CSA) is shown in Monitor > Hosts but not in Manage > Defenders > Cloud security agents.
Application control fails to populate several eligible hosts for import	On Defend > Compliance > Hosts > Application control > Import from host, only a small number of eligible hosts appear in the dropdown even when many active defenders are reporting. App-Embedded and Fargate defenders never appear. Under investigation.
Rhel — Unable to connect rhel container defender to console using podman	RHEL 10 container defenders deployed via Podman log failed to initialize CRI client: runtime version can not be determined and do not appear in the Console.
Automatic deletion of unneeded CVE entries from the intelligence db	Placeholder work item — intelligence DB now automatically removes CVE entries whose Conditions have been null'd by the builder (except RedHat / RedHat-vex and NonVulnerable CVEs). No shipping description yet.
Move from AWS Go SDK v1 to v2	Long-running internal migration off the deprecated AWS Go SDK v1 (EOS after 2025-07-31); currently in Review. May not ship in Update 5.
Fix outdated feeds metric	Internal observability — outdated-feeds metric restoration + threshold tuning.
Intelligence — Several Amazon CVEs are missing CVSS score in Explore feed	Amazon Linux CVE parsing fallback to older CVSS versions is missing; some Amazon CVEs are reported with score 0 even when NVD has a score.
Host defender auto-deployment — Add the option to retain the defender installation log	Customer request to retain twistlock-install.log after host auto-deploy. Still unassigned.
Inconsistency with jar packages names	Some JARs are stored under two different package keys (for example, org.xerial.snappy_snappy-java vs. xerial.org_snappy-java), which causes related CVEs to be missed. Ticket is still New; the ticket carries a partial RN description: "Fixed an issue where old jar versions were not parsed properly." Confirm shipping status.
Amazon Linux CVEs — diff between severity/status in Explore vs. ALAS feeds	Intelligence data-quality gap between Amazon's Explore feed (usually authoritative) and the ALAS RSS feed (fallback). No fix — behavior note only.
CWP API latency degradation — Serverless Functions Evaluate	Latency regression on the Serverless Functions Evaluate route observed between Quinn Update 1 and Quinn Update 2. Related to CRTX-173473.
Intelligence — Go builder schema issue for MAL-YYYY-NNNN IDs	Go builder rejects OSV IDs of the form MAL-2025-NNNN as Invalid schema ID. Staging only.
Intelligence — github: Validation failed for vulnerability.CVEVulnerability	Intelligence staging validation failure for CVE-2023-32198 (rancher/steve).
Intelligence — Skipping long vector CVSS strings	Intelligence staging logs CVSS 4.0 vector strings >170 chars as errors; should be warnings.
Intelligence — RockyLinux CVSS missing, fallback to severity	RockyLinux CVSS missing for several CVEs; Intelligence falls back to severity-based calculation.
Intelligence — pan-os: failed to parse conditions for CVE	pan-os builder fails to parse conditions for CVE-2020-2035, PAN-SA-2025-0005, CVE-2025-0110.
Intelligence — CVE validation errors: wildcards should be alone in condition	Many Go builder CVEs with wildcard conditions fail validation in Intelligence staging.
Intelligence — CVE validation error: invalid operator	Intelligence staging rejects redhat (oval) CVE-2015-5346 with version "\"!=1.1-14.el7" does not have a valid operator.
Optimization — When downloading from Rocky feeds use more specific url	Rocky Linux errata downloader should filter by type_security and by last-updated date.
CWP-63632 34.01.126	Host details display incorrect Windows version Windows Server 2025 is incorrectly reported as Windows Server 2022 on the Host details panel.
--	Google Cloud Run Functions (Gen2) May Not Be Scanned with Selective Registry Scanning Google offers serverless functions in two versions: Cloud Functions ("Gen1") and Cloud Run Functions ("Gen2"). Prisma Cloud fully supports vulnerability scanning for Gen1 functions. For Gen2, when code is uploaded to Google Cloud Run Functions, a container image is created and stored in Google Artifact Registry (GAR) or Google Container Registry (GCR). If Prisma Cloud is set to scan all registries in your GCP account, Gen2 function images will be scanned. To view results, check the relevant registry and refer to Google’s naming conventions for container images here. If Prisma Cloud is configured to scan only selected repositories, the specific repository used by Cloud Run might not be scanned. We are working to support Gen2 function scanning in this scenario.
CWP-62339	Discrepancies in Vulnerability Scan Results In rare instances, discrepancies were observed between vulnerability scan results from Defender and Twistcli host scans. For example, certain compliance checks identified by Twistcli were not reflected in Defender scan results, and vice versa. Additionally, for some operating systems, Twistcli reported a higher number of high-severity findings compared to Defender.