What is the CVSS score of CVE-2026-44218?

CVE-2026-44218 has a CVSS 3.1 base score of 3.0 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44218?

Yes, a patch is available for CVE-2026-44218. Update the affected software to the latest version immediately.

ciguard CVE-2026-44218

LOW

Improper Privilege Management (CWE-269)

2026-05-05 https://github.com/Jo-Jo98/ciguard

GHSA-jrm4-4pcf-4763

Privilege Escalation Docker

3.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.0 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 23:01 vuln.today

Analysis Generated

May 05, 2026 - 23:01 vuln.today

DescriptionGitHub Advisory

Summary

The published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. ciguard is a static analyser with no need for root privileges; running as root inside a container makes any future container-runtime escape CVE more impactful than it needs to be.

Threat scenario

Defence-in-depth gap. Without a known container-runtime CVE in the chain, this finding is not directly exploitable. Recent runc CVEs (e.g. CVE-2024-21626) provided escape primitives that depended on host UID = container UID = 0 for full impact; with this fix, any future such escape primitive lands as a non-root user on the host.

Patch

Dockerfile adds RUN groupadd -r ciguard && useradd -r -g ciguard -d /home/ciguard -m -s /usr/sbin/nologin ciguard && chown -R ciguard:ciguard /reports /policies-mount /app.
Followed by USER ciguard before the CMD directive.
Trivy DS-0002 misconfig clears (Tests: 20 SUCCESSES: 20 FAILURES: 0).

Discovery

Found by Trivy filesystem scan during ciguard's first self-conducted pentest cycle, 2026-04-26.

CVSS Scoring

CVSS v3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - 2.0 (Low)
CVSS v4.0: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - 3.4 (Low) per Cycle 1 report; GitHub's calc 1.8 (Low). Both Low.

Verification

$ docker run --rm ghcr.io/jo-jo98/ciguard:v0.8.2 id
uid=999(ciguard) gid=999(ciguard) groups=999(ciguard)

Resources

Fix released in v0.8.2
CI regression gate added in v0.8.3

AnalysisAI

The ciguard static analysis container image (versions 0.1.0-0.8.1) runs as root due to a missing USER directive in the Dockerfile, creating a privilege-escalation amplification risk for future container-runtime escape vulnerabilities. This is a defence-in-depth gap rather than a directly exploitable vulnerability; it reduces the impact of hypothetical escapes (such as runc CVE-2024-21626) from host-root compromise to non-root user compromise. Vendor-released patch in v0.8.2 adds a dedicated non-root ciguard user and USER directive, verified by container inspection and automated regression testing in v0.8.3.

Technical ContextAI

The vulnerability stems from missing containerization best practice in the Dockerfile: absence of a USER directive causes the container to inherit the default root user (UID 0). ciguard is a static analyser (Python-based, CPE pkg:pip/ciguard) with no operational need for root privileges. The root cause is classified as CWE-269 (Improper Assignment of Privileged Roles). The threat model exploits the principle that container-runtime escape CVEs (such as runc privilege-escalation flaws) have amplified impact when the escaped process already has root privileges. By establishing a non-root user in the Dockerfile and dropping privileges before CMD execution, the patch reduces the blast radius of future escapes: even if a container-runtime bug allows host-system code execution, it executes as the non-root ciguard user rather than root. The fix creates the ciguard group and user, restricts ownership of sensitive directories (/reports, /policies-mount, /app), and sets nologin shell to further limit interactive access.

RemediationAI

Upgrade to ciguard v0.8.2 or later. The patch adds a dedicated non-root user and USER directive to the Dockerfile; verification by running docker run --rm ghcr.io/jo-jo98/ciguard:v0.8.2 id confirms execution as UID 999 (ciguard user) rather than UID 0. For users unable to upgrade immediately, a compensating control is to rebuild the container image locally with an added USER directive: after the base image and application setup, insert RUN groupadd -r ciguard && useradd -r -g ciguard -d /home/ciguard -m -s /usr/sbin/nologin ciguard && chown -R ciguard:ciguard /app /reports /policies-mount followed by USER ciguard before the CMD directive. This approach carries no performance penalty but requires local image build and registry management. Additionally, implement pod security policies or Kubernetes SecurityContext enforcement to set runAsNonRoot: true and runAsUser: <non-zero> in container specs; this provides runtime validation even if the image is misconfigured. v0.8.3 adds permanent CI regression gates to prevent reintroduction of this misconfiguration (https://github.com/Jo-Jo98/ciguard/releases/tag/v0.8.3).