# Prometheus related vulnerability show up even if the project does not use it as a dependency

**URL:** <https://discuss.prometheus.io/t/prometheus-related-vulnerability-show-up-even-if-the-project-does-not-use-it-as-a-dependency/2157>\
**Category:** General Help/Support\
**Created:** [February 22, 2024, 7:14am UTC](https://discuss.prometheus.io/t/prometheus-related-vulnerability-show-up-even-if-the-project-does-not-use-it-as-a-dependency/2157 "2024-02-22T07:14:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ondbyte](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/ondbyte/32/915_2.png) [@ondbyte](https://discuss.prometheus.io/u/ondbyte)\
**Post date:** [February 22, 2024, 7:14am UTC](https://discuss.prometheus.io/t/prometheus-related-vulnerability-show-up-even-if-the-project-does-not-use-it-as-a-dependency/2157/1 "2024-02-22T07:14:30Z")

</div>

Hi community,  
we have a gateway project which uses KrakenD-CE, which only has two plugins with only one having a single dependency, nowhere in the project there is a dependency on prometheus, even go vuln tool doesn’t show any vulnerability but until the project goes into build and crowdstrike scan reports us the built image has [CVE-2019-3826](https://nvd.nist.gov/vuln/detail/CVE-2019-3826) vulnerability, can someone give , me an idea where other than in project the prometheus could have been involved?