Vulnerability remediation

Does anyone have any insight on this? Perhaps point to something I can
read?

1. Vulnerability scanner indicates "Postgres default account:
postgres/no password"
2. Scanner states Proof as "Successfully authenticated to the Postgres
service with credentials uid [postgres] pw [realm]
3. Application owner initially claimed that this was a false positive,
but later claimed that it was resolved within the Docker instance
1. Scanner still showed vulnerability.
4. Found article that seemed to indicate that using the --env would
address the postgres image vs. the Docker.
1. https://squaredup.com/blog/running-postgres-in-docker/
2. Scanner still shows vulnerability.
5. PostGres version is 9.5, if that makes a difference.