تخطَّ إلى المحتوى
QuenchWorks

VEXkubevuln

kubevuln

1 بيان, صدرت في .كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

الصورةOpenVEX JSON

@id https://quench-works.com/vex/kubevuln/2026-10-08

  1. CVE-2026-33997

    غير متأثر · الشيفرة المعرّضة غير موجودة
    • docker v28.5.2+incompatible

    CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. kubevuln v0.3.501 links only Docker API type definitions. Checked with `go list -deps` on both binaries in the CI build (images run 37733699814, both arches): ./cmd/http and ./cmd/sbom-scanner each linked github.com/docker/docker/api/types/filters, api/types/registry and api/types/versions, and no client, daemon, plugin manager or api/server package. The build fails if daemon, plugin or api/server code is ever linked. The fix (29.3.1) exists only under the github.com/moby/moby module path, so the +incompatible module cannot be floated to it.