VEX / kubescape-node-agent

kubescape-node-agent

3 statements, issued 2026-10-08.Each one is a scanner finding that is not exploitable in this image, and why.

@id https://quench-works.com/vex/kubescape-node-agent/2026-10-08

1. CVE-2026-33997

   not affected · vulnerable code not present
   • docker v28.5.2+incompatible

   CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps` on both binaries in the CI build (images run 37738632616, both arches): node-agent v0.3.258 (./cmd) and ./cmd/sbom-scanner each link github.com/docker/docker/client, api, the api/types packages and pkg/homedir, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

2. CVE-2026-33997

   not affected · vulnerable code not present
   • moby v28.5.2+incompatible

   CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps` on both binaries in the CI build (images run 37738632616, both arches): node-agent v0.3.258 (./cmd) and ./cmd/sbom-scanner each link github.com/docker/docker/client, api, the api/types packages and pkg/homedir, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

3. CVE-2026-34040

   not affected · vulnerable code not present
   • moby v28.5.2+incompatible

   CVE-2026-34040 is an authorization bypass in the Moby daemon's AuthZ plugin handling of API requests. Checked with `go list -deps` on both binaries in the CI build (images run 37738632616, both arches): node-agent v0.3.258 (./cmd) and ./cmd/sbom-scanner each link github.com/docker/docker/client, api, the api/types packages and pkg/homedir, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.