VEXtrufflehog
trufflehog
1 declaración, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/trufflehog/2026-10-12
CVE-2026-33997
no afectado · código vulnerable ausente- docker v28.5.2+incompatible
CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. trufflehog (main package .) links only the API types and the client from the module, through pkg/sources/docker and go-containerregistry's pkg/v1/daemon: github.com/docker/docker/api, api/types/* and client. Checked with `go list -deps .` at 3.99.2 with docker v28.5.2 (go.mod identical at 3.98.1, same docker pin at 3.97.9): no daemon, plugin manager or API server package is in the build, and trufflehog never calls the client's plugin endpoints. The build fails if a daemon, plugin or api/server package is ever linked. The fix (29.3.1) exists only under the github.com/moby/moby module path, so the +incompatible module cannot be floated to it.