VEX / kubescape-operator

kubescape-operator

3 بيانات, صدرت في 2026-10-08.كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

@id https://quench-works.com/vex/kubescape-operator/2026-10-08

1. CVE-2026-33997

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • docker v28.5.2+incompatible

   CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps .` in the CI build (images run 37736326583, both arches): the operator v0.2.172 links github.com/docker/docker/client, api and the api/types packages, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

2. CVE-2026-33997

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • moby v28.5.2+incompatible

   CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps .` in the CI build (images run 37736326583, both arches): the operator v0.2.172 links github.com/docker/docker/client, api and the api/types packages, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

3. CVE-2026-34040

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • moby v28.5.2+incompatible

   CVE-2026-34040 is an authorization bypass in the Moby daemon's AuthZ plugin handling of API requests. Checked with `go list -deps .` in the CI build (images run 37736326583, both arches): the operator v0.2.172 links github.com/docker/docker/client, api and the api/types packages, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.