CVE-2026-54248— Doco-CD OCI信任策略绕过漏洞
一分钟漏洞结论
影响对象
kimdre doco-cd
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Doco-CD 是一款 GitOps 持续交付工具，用于自动部署和更新 Docker Compose 项目/服务以及 Swarm 栈。 在 0.90.1 版本之前，在 OCI 工件（artifact）的校验逻辑中存在一个信任边界缺陷，允许通过工件提供的部署配置影响用于验证该工件本身的信任策略。 漏洞详情： 当通过 启用全局 OCI 签名验证（ ）时，拥有已配置 OCI 标签（tag）写权限的攻击者，可以发布一个未签名或签名不规范的工件。该工件中包含的 文件若设置了 ，就可以绕过签名验证，导致不可信的部署内容被应用。
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-54248 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration
来源: CVE Program / CVE List V5
Vulnerability Description
Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`. This could cause signature verification to be bypassed and untrusted deployment content to be applied. This primarily impacts users deploying from OCI artifacts where deployment config is read from artifact contents (for example, poll/webhook flows without trusted inline deployment overrides). The issue is fixed by enforcing a strict trust boundary and no-downgrade behavior. First, artifact-contained `.doco-cd.yml` is treated as untrusted for OCI trust-policy override decisions. Second, if global `OCI_TRUST_POLICY.enabled` is `true`, per-deployment `oci.verify: false` cannot disable verification. Some workarounds are available. Do not source deployment config from untrusted OCI artifact contents. Use trusted inline `POLL_CONFIG.deployments` and avoid relying on artifact-contained trust-policy overrides. Restrict write/push permissions for OCI repositories/tags used by doco-cd. Prefer immutable digest pinning and protected release/tag workflows. Monitor for unexpected artifact digest changes and failed/suspicious verification events.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-54248 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-54248 的情报信息
请登录查看更多情报信息。
CVE-2026-54248 补丁与修复 (1)
CVE-2026-54248 厂商安全公告 (1)
CVE-2026-54248 厂商页面 (1)
-
🔗 Release v0.90.1 · kimdre/doco-cd · GitHub x_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2026-54248
暂无评论