When a container image that is externally sourced is not pinned to their SHA hash, malicious modification of the image can go undetected. For example, an adversary can modify the image with backdoor and the backdoor gets executed as there is no integrity check of the container image.

Remediation

Use SHA hash to pin to the desired version of the container image. This is the only way to always reference the immutability version of the image.