VEXkubescape
kubescape
1 declaración, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/kubescape/2026-10-08b
CVE-2026-33997
no afectado · código vulnerable ausente- docker v28.5.2+incompatible
CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. The image's three binaries (kubescape, ksserver from ./httphandler, downloader) link only Docker client code. Checked with `go list -deps` on each in the CI build (images run 37738537104, both arches): every one linked github.com/docker/docker/client, api, the api/types packages, pkg/homedir and pkg/namesgenerator, plus the split github.com/moby/moby/api and moby/moby/client modules, and no daemon, plugin manager, api/server or pkg/authorization package. The build fails if one is ever linked. The fix (29.3.1) exists only under the github.com/moby/moby module path, so the +incompatible module cannot be floated to it.