Skip to content
QuenchWorks

VEXkubescape-operator

kubescape-operator

3 statements, issued .Each one is a scanner finding that is not exploitable in this image, and why.

ImageOpenVEX JSON

@id https://quench-works.com/vex/kubescape-operator/2026-10-08

  1. CVE-2026-33997

    not affected · vulnerable code not present
    • docker v28.5.2+incompatible

    CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps .` in the CI build (images run 37736326583, both arches): the operator v0.2.172 links github.com/docker/docker/client, api and the api/types packages, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

  2. CVE-2026-33997

    not affected · vulnerable code not present
    • moby v28.5.2+incompatible

    CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. Checked with `go list -deps .` in the CI build (images run 37736326583, both arches): the operator v0.2.172 links github.com/docker/docker/client, api and the api/types packages, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.

  3. CVE-2026-34040

    not affected · vulnerable code not present
    • moby v28.5.2+incompatible

    CVE-2026-34040 is an authorization bypass in the Moby daemon's AuthZ plugin handling of API requests. Checked with `go list -deps .` in the CI build (images run 37736326583, both arches): the operator v0.2.172 links github.com/docker/docker/client, api and the api/types packages, and from github.com/moby/moby only pkg/stringid (a random ID helper); no daemon, plugin manager, api/server or pkg/authorization package of either module path. The build fails if one is ever linked. The fix (29.3.1) exists only under the new moby module path, so the +incompatible modules cannot be floated to it.