CVE-2026-54248

Received Received - Intake

Trust Boundary Bypass in Doco-CD OCI Artifact Verification

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`. This could cause signature verification to be bypassed and untrusted deployment content to be applied. This primarily impacts users deploying from OCI artifacts where deployment config is read from artifact contents (for example, poll/webhook flows without trusted inline deployment overrides). The issue is fixed by enforcing a strict trust boundary and no-downgrade behavior. First, artifact-contained `.doco-cd.yml` is treated as untrusted for OCI trust-policy override decisions. Second, if global `OCI_TRUST_POLICY.enabled` is `true`, per-deployment `oci.verify: false` cannot disable verification. Some workarounds are available. Do not source deployment config from untrusted OCI artifact contents. Use trusted inline `POLL_CONFIG.deployments` and avoid relying on artifact-contained trust-policy overrides. Restrict write/push permissions for OCI repositories/tags used by doco-cd. Prefer immutable digest pinning and protected release/tag workflows. Monitor for unexpected artifact digest changes and failed/suspicious verification events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-54248

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-501	The product mixes trusted and untrusted data in the same data structure or structured message.
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

Doco-CD is a GitOps tool for deploying Docker Compose projects. Prior to version 0.90.1, a flaw allowed deployment config inside OCI artifacts to bypass signature verification. If an attacker with write access to an OCI tag published an unsigned artifact containing a .doco-cd.yml file with oci.verify set to false, signature checks could be disabled, allowing untrusted deployment content to be applied.

Detection Guidance

Detecting this vulnerability requires checking for misconfigured OCI artifact verification in Doco-CD deployments. Inspect Doco-CD configuration files for `OCI_TRUST_POLICY.enabled: true` and verify if `.doco-cd.yml` files are sourced from untrusted OCI artifacts. Check OCI repository logs for unsigned artifacts or unexpected digest changes.

Impact Analysis

This vulnerability could allow attackers to deploy unauthorized or malicious Docker Compose configurations by bypassing signature verification. This may lead to unauthorized access, data breaches, or service disruptions in systems relying on Doco-CD for deployments.

Compliance Impact

This vulnerability could lead to unauthorized deployments, potentially violating compliance requirements for data protection and integrity. For example, GDPR requires ensuring data processing integrity, and HIPAA mandates secure configuration management. Bypassing verification may result in non-compliance due to unauthorized changes.

Mitigation Strategies

Upgrade Doco-CD to version 0.90.1 or later. Disable sourcing deployment config from OCI artifact contents. Use trusted inline POLL_CONFIG.deployments instead. Restrict write permissions for OCI repositories/tags. Enable immutable digest pinning and monitor for failed verification events.

Hi! I’m here to help you understand CVE-2026-54248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70