CVE-2026-44218 PUBLISHED

ciguard: Container image runs as root (no USER directive)

Assigner: GitHub_M
Reserved: 05.05.2026 Published: 12.05.2026 Updated: 12.05.2026

ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. This vulnerability is fixed in 0.8.2.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 3

Attack Vector	Local	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Jo-Jo98
Product	ciguard
Versions	Version >= 0.1.0, < 0.8.2 is affected

References

https://github.com/Jo-Jo98/ciguard/security/advisories/GHSA-jrm4-4pcf-4763

Problem Types

CWE-269: Improper Privilege Management CWE