Skip to content
QuenchWorks

VEXvcluster

vcluster

1 statement, issued .Each one is a scanner finding that is not exploitable in this image, and why.

ImageOpenVEX JSON

@id https://quench-works.com/vex/vcluster/2026-09-26

  1. CVE-2026-33997

    not affected · vulnerable code not present
    • docker v28.5.2+incompatible
    • docker v28.3.3+incompatible

    CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. The vCluster syncer (./cmd/vcluster) links exactly one package from the module: github.com/docker/docker/pkg/homedir, a helper that returns the user's home directory, reached through github.com/docker/cli/cli/config/credentials. Checked with `go list -deps ./cmd/vcluster` at v0.37.2 (docker v28.5.2) and v0.35.4 (docker v28.3.3): no daemon, plugin or API server package is in the build. The fix (29.3.1) exists only under the github.com/moby/moby module path, so the +incompatible module cannot be floated to it. Scoped to these exact versions: a tag that links more of docker/docker must be re-checked.