CVE-2026-54248

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`. This could cause signature verification to be bypassed and untrusted deployment content to be applied. This primarily impacts users deploying from OCI artifacts where deployment config is read from artifact contents (for example, poll/webhook flows without trusted inline deployment overrides). The issue is fixed by enforcing a strict trust boundary and no-downgrade behavior. First, artifact-contained `.doco-cd.yml` is treated as untrusted for OCI trust-policy override decisions. Second, if global `OCI_TRUST_POLICY.enabled` is `true`, per-deployment `oci.verify: false` cannot disable verification. Some workarounds are available. Do not source deployment config from untrusted OCI artifact contents. Use trusted inline `POLL_CONFIG.deployments` and avoid relying on artifact-contained trust-policy overrides. Restrict write/push permissions for OCI repositories/tags used by doco-cd. Prefer immutable digest pinning and protected release/tag workflows. Monitor for unexpected artifact digest changes and failed/suspicious verification events.

• CWE-347
• CWE-501

• https://github.com/kimdre/doco-cd/pull/1407
• https://github.com/kimdre/doco-cd/releases/tag/v0.90.1
• https://github.com/kimdre/doco-cd/security/advisories/GHSA-5rv3-qpp3-6jp5

Published

Sep 11, 2026

Last Modified

Sep 14, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54242Statamic is a Laravel and Git powered content management sys…4.9
• CVE-2026-54243Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-54244Statamic is a Laravel and Git powered content management sys…3.5
• CVE-2026-54245Fleet is an open-source device management platform built on …7.6
• CVE-2026-54246Skipper is an HTTP router and reverse proxy for service comp…5.7
• CVE-2026-54247Skipper is an HTTP router and reverse proxy for service comp…4.3
• CVE-2026-54249Pydantic AI is a Python agent framework for building Generat…6.8
• CVE-2026-5425The Widgets for Social Photo Feed plugin for WordPress is vu…7.2
• CVE-2026-54250K3s is a fully conformant production-ready Kubernetes distri…5.8
• CVE-2026-54251netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP…8.7
• CVE-2026-54253TS3 Manager is modern web interface for maintaining Teamspea…8.2
• CVE-2026-54254Cyberdrop-DL is a bulk asynchronous downloader for multiple …5.9