tag: Container-Security · 6 items
- Engineer — Plan: Teams running LXD or MicroCloud clusters should prioritize patching — an authentication bypass at CVSS 10.0 could allow cluster takeover and VM access. No KEV listing or public PoC in the enrichment signals, but the attack surface (network-reachable HTTPS API) warrants patching this sprint rather than waiting for a routine cycle.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: A perfect-score CVSS on a container/VM hypervisor warrants attention, but EPSS is 0.00, no PoC exists, and the source summary is too thin to confirm patch availability or vulnerability class — monitor Canonical’s advisory for LXD version details before acting.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-112816 — CISA KEV: not listed, EPSS 0.00, no public PoC found
- Engineer — Plan: No client-side patch needed — Docker fixed this server-side — but teams should audit Docker Hub image push history over the past two years to verify no unauthorized image modifications occurred in repositories they own or depend on.
- SOC/IR — Learn: No active exploitation, no IOCs, and no published PoC; the risk class — unauthorized registry writes enabling supply-chain poisoning — is worth factoring into future container image integrity detections, but there is no hunt to run today.
- Leader — Learn: Docker’s own advisory states no confirmed exploitation in two years, so no immediate vendor-breach response is needed; file this as evidence of supply-chain risk exposure through shared registries for future vendor risk reviews of Docker Hub dependency.
- Engineer — Plan: Docker Hub patched this server-side, but any org using Docker Hub PATs should audit token activity for unauthorized access and verify image digests for unexpected modifications, particularly for images pulled before the patch window.
- SOC/IR — Plan: No IOCs or active exploitation reported, but review Docker Hub audit logs for anomalous PAT usage; build or tune detections for unauthorized container registry access as this TTP (token-based impersonation enabling image tampering) could resurface.
- Leader — Plan: This is a supply-chain risk event — confirm Docker has fully remediated the server-side flaw, review your organization’s PAT governance policy for Docker Hub, and flag this class of risk (registry impersonation enabling tampered images) as a standing vendor-risk consideration.
- Signals: CVE-2026-105445 — CISA KEV: not listed, EPSS n/a, no public PoC found
- Engineer — Plan: If your org runs workloads on Cloudflare Containers, audit what sensitive data those containers wrote to disk — it was potentially readable by other tenants before the fix. No patch action on your end; Cloudflare remediated server-side, but assess whether any secrets, credentials, or PII touched container disk storage.
- SOC/IR — Skip
- Leader — Plan: If Cloudflare Containers is in your environment, confirm with your engineering team what data was stored on container disk volumes and whether it could constitute a material data exposure requiring customer notification or regulatory disclosure review.
- Engineer — Act: CISA KEV listed, EPSS 0.96, and public PoC on GitHub — exploitation is active and practical. Identify your container runtime version, patch to the fixed release immediately, and audit container environments for signs of exploitation.
- SOC/IR — Act: Active exploitation confirmed via CISA KEV; hunt for container escape and unexpected privilege escalation events in your EDR and container logs since the PoC dropped in early May 2026, and tune detections for abnormal rootless container behavior.
- Leader — Plan: CISA KEV listing and near-perfect EPSS signal active exploitation in the wild; confirm with engineering that all container runtime deployments are on a patched version and add this to the sprint’s prioritized patch list.
- Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.96, public PoC on GitHub