VEX / kubescape-node-agent

kubescape-node-agent

3 declaraciones, emitidas el 2026-10-08.Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.

@id https://quench-works.com/vex/kubescape-node-agent/2026-10-08

1. CVE-2026-33997

   no afectado · código vulnerable ausente
   • docker v28.5.2+incompatible

   CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps` on both binaries in the CI build (images run 37738632616, both arches): node-agent v0.3.258 (./cmd) and ./cmd/sbom-scanner each link github.com/docker/docker/client, api, the api/types packages and pkg/homedir, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

2. CVE-2026-33997

   no afectado · código vulnerable ausente
   • moby v28.5.2+incompatible

   CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps` on both binaries in the CI build (images run 37738632616, both arches): node-agent v0.3.258 (./cmd) and ./cmd/sbom-scanner each link github.com/docker/docker/client, api, the api/types packages and pkg/homedir, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

3. CVE-2026-34040

   no afectado · código vulnerable ausente
   • moby v28.5.2+incompatible

   CVE-2026-34040 is an authorization bypass in the Moby daemon's AuthZ plugin handling of API requests. Checked with `go list -deps` on both binaries in the CI build (images run 37738632616, both arches): node-agent v0.3.258 (./cmd) and ./cmd/sbom-scanner each link github.com/docker/docker/client, api, the api/types packages and pkg/homedir, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.