EUVD-2026-76757Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
PR:H reflects mandatory OCI registry write/push access; no confidentiality impact because the attacker injects deployment config rather than reading secrets.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via OCI_TRUST_POLICY (enabled: true), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing .doco-cd.yml with oci.verify: false. This could cause signature verification to be bypassed and untrusted deployment content to be applied. This primarily impacts users deploying from OCI artifacts where deployment config is read from artifact contents (for example, poll/webhook flows without trusted inline deployment overrides). The issue is fixed by enforcing a strict trust boundary and no-downgrade behavior. First, artifact-contained .doco-cd.yml is treated as untrusted for OCI trust-policy override decisions. Second, if global OCI_TRUST_POLICY.enabled is true, per-deployment oci.verify: false cannot disable verification. Some workarounds are available. Do not source deployment config from untrusted OCI artifact contents. Use trusted inline POLL_CONFIG.deployments and avoid relying on artifact-contained trust-policy overrides. Restrict write/push permissions for OCI repositories/tags used by doco-cd. Prefer immutable digest pinning and protected release/tag workflows. Monitor for unexpected artifact digest changes and failed/suspicious verification events.
AnalysisAI
OCI artifact signature verification bypass in Doco-CD prior to v0.90.1 allows an attacker with write access to a monitored OCI registry tag to circumvent the global OCI_TRUST_POLICY enforcement and deploy unsigned or improperly signed artifacts. By publishing an artifact containing a crafted .doco-cd.yml with oci.verify: false, the attacker exploits a circular trust dependency - the tool reads per-deployment config from artifact contents before verifying that artifact - causing signature checking to be disabled for that same artifact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be true for exploitation: (1) The target Doco-CD instance must have global OCI signature verification explicitly enabled via OCI_TRUST_POLICY with enabled: true - if this policy is disabled or absent, there is no verification to bypass; (2) The attacker must have write/push access to the specific OCI registry tag or repository that the Doco-CD instance is configured to poll or receive webhooks for; (3) The affected deployment flow must source its deployment configuration from artifact-contained .doco-cd.yml files rather than from trusted inline POLL_CONFIG.deployments overrides. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score and PR:H vector accurately reflect the key limiting factor: write/push access to the OCI repository or tag being monitored is required, which meaningfully restricts casual exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Doco-CD to version 0.90.1, which enforces a no-downgrade trust boundary ensuring that artifact-contained .doco-cd.yml cannot disable OCI signature verification when OCI_TRUST_POLICY.enabled is true. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today