stackrox · ajheflin · Apr 17, 2026 · Apr 9, 2026 · Mar 27, 2026 · Apr 1, 2026
diff --git a/central/virtualmachine/v2/service/service_impl.go b/central/virtualmachine/v2/service/service_impl.go
@@ -506,3 +506,143 @@ func countFixability(counts *v2.VulnCountBySeverity) (fixable, notFixable int32)
 	}
 	return
 }
+
+// GetVMCVEDetail returns detailed information about a specific CVE across all VMs.
+func (s *serviceImpl) GetVMCVEDetail(ctx context.Context, request *v2.GetVMCVEDetailRequest) (*v2.VMCVEDetail, error) {
+	if request.GetCveId() == "" {
+		return nil, status.Error(codes.InvalidArgument, "cve_id must be specified")
+	}
+
+	// Look up by CVE identifier (e.g. "CVE-2024-1234"), not by internal UUID.
+	cveFilter := search.NewQueryBuilder().AddExactMatches(search.CVE, request.GetCveId()).ProtoQuery()
+	cves, err := s.cveDS.SearchRawVMCVEs(ctx, cveFilter)
+	if err != nil {
+		return nil, err
+	}
+	if len(cves) == 0 {
+		return nil, status.Errorf(codes.NotFound, "CVE %q not found", request.GetCveId())
+	}
+	cve := cves[0]
+	severityCounts, err := s.cveView.CountBySeverity(ctx, cveFilter)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get affected VM count.
+	affectedVMIDs, err := s.cveView.GetVMIDs(ctx, cveFilter.CloneVT())
+	if err != nil {
+		return nil, err
+	}
+
+	totalVMs, err := s.vmDS.CountVirtualMachines(ctx, search.EmptyQuery())
+	if err != nil {
+		return nil, err
+	}
+
+	// Count distinct guest OSes among affected VMs.
+	affectedGuestOSCount := 0
+	if len(affectedVMIDs) > 0 {
+		affectedVMs, _, err := s.vmDS.GetManyVirtualMachines(ctx, affectedVMIDs)
+		if err != nil {
+			return nil, err
+		}
+		guestOSSet := make(map[string]struct{})
+		for _, vm := range affectedVMs {
+			if os := vm.GetGuestOs(); os != "" {
+				guestOSSet[os] = struct{}{}
+			}
+		}
+		affectedGuestOSCount = len(guestOSSet)
+	}
+
+	return &v2.VMCVEDetail{
+		Cve:                  cve.GetCveBaseInfo().GetCve(),
+		Summary:              cve.GetCveBaseInfo().GetSummary(),
+		Link:                 cve.GetCveBaseInfo().GetLink(),
+		EpssProbability:      cve.GetEpssProbability(),
+		PublishedOn:          cve.GetCveBaseInfo().GetPublishedOn(),
+		FirstDiscovered:      cve.GetCveBaseInfo().GetCreatedAt(),
+		AffectedVmCount:      int32(len(affectedVMIDs)),
+		TotalVmCount:         int32(totalVMs),
+		AffectedGuestOsCount: int32(affectedGuestOSCount),
+		VmSeverityCounts:     storagetov2.SeverityCountsToProto(severityCounts),
+		TopCvss:              cve.GetPreferredCvss(),
+	}, nil
+}
+
+// ListVMCVEAffectedVMs returns VMs affected by a specific CVE.
+// TODO(ROX-34181): Replace with a SQL view to enable proper pagination.
+func (s *serviceImpl) ListVMCVEAffectedVMs(ctx context.Context, request *v2.ListVMCVEAffectedVMsRequest) (*v2.ListVMCVEAffectedVMsResponse, error) {
+	if request.GetCveId() == "" {
+		return nil, status.Error(codes.InvalidArgument, "cve_id must be specified")
+	}
+
+	searchQuery, err := search.ParseQuery(request.GetQuery().GetQuery(), search.MatchAllIfEmpty())
+	if err != nil {
+		return nil, errors.Wrap(err, "parsing input query")
+	}
+	searchQuery = search.ConjunctionQuery(
+		searchQuery,
+		search.NewQueryBuilder().AddExactMatches(search.CVE, request.GetCveId()).ProtoQuery(),
+	)
+
+	// Get all CVE records matching this CVE identifier to find affected VMs.
+	cves, err := s.cveDS.SearchRawVMCVEs(ctx, searchQuery)
+	if err != nil {
+		return nil, err
+	}
+
+	// Build per-VM aggregation: for each VM, pick the highest severity CVE record.
+	type vmCVEInfo struct {
+		severity       v2.VulnerabilitySeverity
+		isFixable      bool
+		cvss           float32
+		componentCount int
+	}
+	vmMap := make(map[string]*vmCVEInfo)
+	for _, cve := range cves {
+		info, ok := vmMap[cve.GetVmV2Id()]
+		if !ok {
+			info = &vmCVEInfo{}
+			vmMap[cve.GetVmV2Id()] = info
+		}
+		info.componentCount++
+		severity := v2.VulnerabilitySeverity(cve.GetSeverity())
+		if severity > info.severity {
+			info.severity = severity
+			info.cvss = cve.GetPreferredCvss()
+		}
+		if cve.GetIsFixable() {
+			info.isFixable = true
+		}
+	}
+
+	vmIDs := make([]string, 0, len(vmMap))
+	for id := range vmMap {
+		vmIDs = append(vmIDs, id)
+	}
+
+	vms, _, err := s.vmDS.GetManyVirtualMachines(ctx, vmIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	rows := make([]*v2.VMCVEAffectedVMRow, 0, len(vms))
+	for _, vm := range vms {
+		info := vmMap[vm.GetId()]
+		rows = append(rows, &v2.VMCVEAffectedVMRow{
+			VmId:                   vm.GetId(),
+			VmName:                 vm.GetName(),
+			Severity:               info.severity,
+			IsFixable:              info.isFixable,
+			Cvss:                   info.cvss,
+			GuestOs:                vm.GetGuestOs(),
+			AffectedComponentCount: int32(info.componentCount),
+		})
+	}
+
+	return &v2.ListVMCVEAffectedVMsResponse{
+		Vms:        rows,
+		TotalCount: int32(len(rows)),
+	}, nil
+}
diff --git a/central/virtualmachine/v2/service/service_impl_test.go b/central/virtualmachine/v2/service/service_impl_test.go
@@ -441,6 +441,95 @@ func TestListVMComponents(t *testing.T) {
 	}
 }
 
+func TestGetVMCVEDetail(t *testing.T) {
+	ctx := context.Background()
+
+	cve1 := &storage.VirtualMachineCVEV2{
+		Id: "cve-uuid-1",
+		CveBaseInfo: &storage.CVEInfo{
+			Cve:     "CVE-2024-1234",
+			Summary: "test vulnerability",
+			Link:    "https://example.com",
+		},
+		PreferredCvss:   7.5,
+		EpssProbability: 0.5,
+	}
+
+	tests := map[string]struct {
+		request       *v2.GetVMCVEDetailRequest
+		setupMock     func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView)
+		expectedError string
+	}{
+		"empty cve_id": {
+			request: &v2.GetVMCVEDetailRequest{
+				CveId: "",
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+			},
+			expectedError: "cve_id must be specified",
+		},
+		"CVE not found": {
+			request: &v2.GetVMCVEDetailRequest{
+				CveId: "CVE-2024-1234",
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return(nil, nil)
+			},
+			expectedError: "not found",
+		},
+		"successful detail": {
+			request: &v2.GetVMCVEDetailRequest{
+				CveId: "CVE-2024-1234",
+			},
+			setupMock: func(mockVM *vmDSMocks.MockDataStore, mockCVE *cveDSMocks.MockDataStore, mockComp *componentDSMocks.MockDataStore, mockScan *scanDSMocks.MockDataStore, mockView *cveViewMocks.MockCveView) {
+				mockCVE.EXPECT().SearchRawVMCVEs(ctx, gomock.Any()).Return([]*storage.VirtualMachineCVEV2{cve1}, nil)
+				mockView.EXPECT().CountBySeverity(ctx, gomock.Any()).Return(&commonViews.ResourceCountByImageCVESeverity{
+					CriticalSeverityCount: 2,
+				}, nil)
+				mockView.EXPECT().GetVMIDs(ctx, gomock.Any()).Return([]string{"vm-1"}, nil)
+				mockVM.EXPECT().CountVirtualMachines(ctx, gomock.Any()).Return(5, nil)
+				mockVM.EXPECT().GetManyVirtualMachines(ctx, []string{"vm-1"}).Return([]*storage.VirtualMachineV2{
+					{Id: "vm-1", GuestOs: "rhel-9"},
+				}, nil, nil)
+			},
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
+
+			mockVM := vmDSMocks.NewMockDataStore(ctrl)
+			mockCVE := cveDSMocks.NewMockDataStore(ctrl)
+			mockComp := componentDSMocks.NewMockDataStore(ctrl)
+			mockScan := scanDSMocks.NewMockDataStore(ctrl)
+			mockView := cveViewMocks.NewMockCveView(ctrl)
+
+			service := &serviceImpl{
+				vmDS:        mockVM,
+				cveDS:       mockCVE,
+				componentDS: mockComp,
+				scanDS:      mockScan,
+				cveView:     mockView,
+			}
+
+			tt.setupMock(mockVM, mockCVE, mockComp, mockScan, mockView)
+
+			result, err := service.GetVMCVEDetail(ctx, tt.request)
+
+			if tt.expectedError != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedError)
+				assert.Nil(t, result)
+			} else {
+				require.NoError(t, err)
+				assert.NotNil(t, result)
+			}
+		})
+	}
+}
+
 func TestListVMs(t *testing.T) {
 	ctx := context.Background()