What is the CVSS score of CVE-2026-42298?

CVE-2026-42298 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Docker are affected by CVE-2026-42298?

Postiz (gitroomhq/postiz-app) contains a critical GitHub Actions workflow vulnerability allowing any unauthenticated user to execute arbitrary code and steal repository write privileges, enabling…

How to fix or mitigate CVE-2026-42298?

Within 24 hours: verify Postiz deployment version and confirm whether you're affected (prior to commit da44801). Within 7 days: if using Postiz, pin to a known-good commit post-da44801 or disable automated updates; restrict GitHub Actions permissions on any internal projects using the pull_request_target pattern. Within 30 days: await vendor patch confirmation and upgrade immediately upon release; conduct supply chain audit of any Postiz releases or artifacts used in production.

Docker CVE-2026-42298

CRITICAL

Code Injection (CWE-94)

2026-05-08 GitHub_M

RCE Docker Code Injection Postiz App Gitroomhq

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 24, 2026 - 21:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Source Code Evidence Fetched

Jul 24, 2026 - 00:27 vuln.today

Analysis Generated

Jul 24, 2026 - 00:27 vuln.today

CVE Published

May 08, 2026 - 22:24 nvd

CRITICAL 10.0

DescriptionNVD

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.

AnalysisAI

Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 through an insecure GitHub Actions 'Pwn Request' pattern in the Build and Publish PR Docker Image workflow. Because the workflow triggers on pull_request_target with 'permissions: write-all' yet checks out and builds the untrusted fork head (Dockerfile.dev), any unauthenticated GitHub user can open a fork PR with a malicious Dockerfile.dev to run code on the runner and exfiltrate a write-all GITHUB_TOKEN, effectively hijacking the repository's CI/CD supply chain. Rated CVSS 10.0 with SSVC technical impact 'total' and automatable 'yes', but EPSS is low (0.14%) with no public exploit or KEV listing at time of analysis.