BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-951a6725b8 advisory.

    - Update to release v5.1.4
    - Resolves: rhbz#2480186
    - Upstream fixes

    ----

    - Update to release v5.1.3
    - Resolves rhbz#2458697
    - Resolves CVE-2026-33747: rhbz#2452188, rhbz#2452199
    - Resolves CVE-2026-33748: rhbz#2453089
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3316f97296 advisory.

    - Update to release v5.1.4
    - Resolves: rhbz#2480186
    - Upstream fixes

    ----

    - Update to release v5.1.3
    - Resolves rhbz#2458697
    - Resolves CVE-2026-33747: rhbz#2452188, rhbz#2452199
    - Resolves CVE-2026-33748: rhbz#2453089
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20814-1 advisory.

    This update for docker-stable fixes the following issues

    - CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to     be written       outside of the BuildKit state directory (bsc#1260967).
    - CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components     may allow       access to files outside the checked-out Git repository (bsc#1261078).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1671 advisory.

    SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early     termination of the client process. (CVE-2025-47913)

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components     may allow access to files outside the checked-out Git repository root. Possible access is limited to files     on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds     that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted     sources or using the subdir component from an untrusted Git repository where the subdir component could     point to a symlink. (CVE-2026-33748)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f5bc7ff320 advisory.

    Automatic update for docker-compose-5.1.3-1.fc45.

    ##### **Changelog**

    ```
    * Wed Apr 15 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 5.1.3-1
    - Update to release v5.1.3
    - Resolves rhbz#2458697
    - Resolves CVE-2026-33747: rhbz#2452188, rhbz#2452199
    - Resolves CVE-2026-33748: rhbz#2453089
    - Upstream fixes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runfinch-finch installed on the remote host is prior to 1.17.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-117 advisory.

    SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early     termination of the client process. (CVE-2025-47913)

    Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the     Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime,     potentially leading to memory corruption in programs compiled with affected Go versions. (CVE-2026-27143)

    The Go compiler (cmd/compile) incorrectly handled no-op interface conversions, preventing correct     determination about non-overlapping memory moves, potentially leading to memory corruption at runtime in     programs compiled with affected Go versions. (CVE-2026-27144)

    During chain building, the amount of work that is done is not correctly limited when a large number of     intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of     service. This affects both direct users of crypto/x509 and users of crypto/tls. (CVE-2026-32280)

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the     chain contain a very large number of policy mappings, possibly causing denial of service. This only     affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots     CertPool, or in the system certificate pool. (CVE-2026-32281)

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,     Chmod can operate on the target of the symlink, even when the target lies outside the root.
    (CVE-2026-32282)

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,     the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of     service. This only affects TLS 1.3. (CVE-2026-32283)

    tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive     containing a large number of sparse regions encoded in the old GNU sparse map format. (CVE-2026-32288)

    Context was not properly tracked across template branches for JS template literals, leading to possibly     incorrect escaping of content. This could cause actions within JS template literals to be incorrectly     escaped, leading to XSS vulnerabilities. (CVE-2026-32289)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components     may allow access to files outside the checked-out Git repository root. Possible access is limited to files     on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds     that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted     sources or using the subdir component from an untrusted Git repository where the subdir component could     point to a symlink. (CVE-2026-33748)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20702-1 advisory.

    Changes in trivy:

    - Update to version 0.70.0 (          bsc#1260193, CVE-2026-33186,          bsc#1260971, CVE-2026-33747,          bsc#1261052, CVE-2026-33748,          bsc#1262389, CVE-2026-39984,          bsc#1262893, CVE-2026-34986):
      * release: v0.70.0 [main] (#10105)
      * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#10496)
      * chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#10526)
      * chore(deps): bump the common group across 1 directory with 8 updates (#10540)
      * chore(deps): bump the docker group across 1 directory with 2 updates (#10538)
      * fix: use Development category for GoReleaser discussions (#10530)
      * chore(deps): bump testcontainers-go to v0.42.0 (#10531)
      * chore: update CODEOWNERS (#10529)
      * chore(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 (#10511)
      * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#10510)
      * chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 (#10449)
      * ci: migrate from mkdocs-material-insiders to mkdocs-material (#10509)
      * chore: remove aquasecurity/homebrew-trivy tap from GoReleaser (#10508)
      * ci: update runners for workflows that interact with GitHub API (#10502)
      * ci: rename tokens and update runners (#10500)
      * ci: trigger helm chart publishing via helm-charts workflow (#10474)
      * ci: remove ruleset update step from release-please workflow (#10499)
      * ci: use large runner and replace ORG_REPO_TOKEN in release-please workflow (#10498)
      * ci: trigger rpm/deb deployment via trivy-repo workflow (#10476)
      * fix: remove os.Stdout from wazero module config (#10403)
      * chore(deps): bump the common group across 1 directory with 22 updates (#10408)
      * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#10407)
      * fix(flag): validate template file extension (#10296)
      * fix(sbom): preserve Red Hat BuildInfo when scanning SBOMs without layer info (#10378)
      * fix: handle Go 1.26 GOEXPERIMENT version format change (#10351)
      * fix(python): handle multiple version specifiers in requirements.txt (#10361)
      * ci: run Trivy version bump in trivy-action (#10272)
      * fix(python): nil pointer dereference with optional poetry groups without dependencies (#10359)
      * ci: replace personal email with github-actions[bot] in workflows (#10369)
      * chore: replace smithy epoch parsing with stdlib time.Unix (#10286)
      * test: update golden files for purl changes (#10372)
      * ci: add zizmor to scan GitHub Actions workflows (#10322)
      * refactor: log statuses as strings (#10285)
      * ci: add build provenance attestations for release artifacts (#10316)
      * fix(sbom): add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages (#10368)
      * fix(report): set correct sarif ROOTPATH uri when scanning a git repository (#10366)
      * perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir (#10325)
      * docs: correct typos in CHANGELOG and diagram (#10320)
      * chore: delete roadmap wf (#10295)
      * ci(helm): bump Trivy version to 0.69.3 for Trivy Helm Chart 0.21.3 (#10310)
      * fix(cyclonedx): include CVSS v4 vulnerability ratings (#10313)
      * fix: detected vulnerability fields in azure and mariner detector (#10275)
      * ci: add persist-credentials: false to checkout steps (#10306)
      * ci(helm): bump Trivy version to 0.69.2 for Trivy Helm Chart 0.21.2 (#10270)
      * chore(deps): bump the common group across 1 directory with 8 updates (#10248)
      * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#10257)
      * chore(deps): bump the aws group across 1 directory with 6 updates (#10249)
      * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#10241)
      * ci: remove apidiff workflow (#10259)
      * chore(deps): bump github.com/docker/cli from 29.1.4+incompatible to 29.2.1+incompatible in the docker     group across 1 directory (#10221)
      * ci: bump golangci-lint to v2.10 in cache-test-assets (#10243)
      * feat(java): add support for proxy configuration from Maven settings.xml (#10187)
      * chore(deps): bump the github-actions group across 3 directories with 11 updates (#10242)
      * feat(python): add pylock.toml support (#10137)
      * chore: bump SPDX license IDs and exceptions to `v3.28.0` (#10233)
      * docs: fix typos and upgrade insecure HTTP links to HTTPS (#10219)
      * chore: bump golangci-lint to v2.10.0 (#10223)
      * feat(misconf): support for azurerm_network_interface_security_group_association  (#10215)
      * ci: pin Docker Engine to v29 for integration tests (#10232)
      * feat(go): detect version from ELF symbol table for binaries built with -trimpath (#10197)
      * docs: migrate private registry documentation from GCR to GAR (#10208)
      * chore(deps): bump the common group across 1 directory with 24 updates (#10206)
      * chore(deps): update Docker client SDK to v29 (#10202)
      * test: update Docker Engine integration tests for Docker API v0.29.0+ compatibility (#10199)
      * fix(misconf): initialize custom annotation field if empty (#10123)
      * feat(ubuntu): add eol data for 25.10 (#10181)
      * docs: fix incorrect count of Python package managers (#10175)
      * chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (#10179)
      * feat(misconf): resolve Azure resources via resource_id (#10173)
      * ci(helm): bump Trivy version to 0.69.1 for Trivy Helm Chart 0.21.1 (#10155)
      * refactor: remove unused Insecure field from ServiceOption (#10113)
      * refactor: reduce complexity of init in detect.go (#10163)
      * feat(misconf): adapt ARM k8s clusters (#9696) (#10125)
      * docs: update version endpoint example in client/server documentation (#10151)
      * feat(vuln): skip third-party packages in common Detect function (#10129)
      * ci: add composite action for Go setup (#10146)
      * fix(misconf): apply check aliases when filtering results via .trivyignore (#10112)
      * docs(terraform): add limitation for data sources and computed resource attributes (#10128)
      * fix: update PhotonOS feed URL (#10122)
      * feat(server): include server version info in JSON output for client/server mode (#10075)
      * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs (#10107)
      * refactor: unify scanner error limit and compiler limit (#10106)
      * ci(helm): bump Trivy version to 0.69.0 for Trivy Helm Chart 0.21.0 (#10103)
      * fix(java): Disable overwriting exclusions (#10088)
      * refactor(rust): use txtar format for cargo analyzer test data (#10104)
      * feat(python): add pylock.toml (PEP 751) parser (#9632)
      * chore(deps): bump the aws group across 1 directory with 6 updates (#10068)
      * fix(server): exclude JavaDB and CheckBundle from /version endpoint (#10100)

    - Update to version 0.69.3 (CVE-2026-25934, bsc#1258094):
      * release: v0.69.3 [release/v0.69] (#10293)
      * fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#10291)
      * release: v0.69.2 [release/v0.69] (#10266)
      * fix(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 [backport: release/v0.69] (#10267)
      * fix(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 [backport: release/v0.69] (#10264)
      * ci: remove apidiff workflow
      * release: v0.69.1 [release/v0.69] (#10145)
      * ci: add composite action for Go setup [backport: release/v0.69] (#10150)
      * fix(misconf): apply check aliases when filtering results via .trivyignore [backport: release/v0.69]     (#10143)
      * chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs [backport: release/v0.69] (#10135)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8230-1 advisory.

    It was discovered that BuildKit, contained within Docker, incorrectly handled file path validation when     processing frontend API messages. An attacker could possibly use this issue to write files outside of the     intended state directory. (CVE-2026-33747)

    It was discovered that BuildKit, contained within Docker, incorrectly validated the subdir component of     Git URL fragments. An attacker could possibly use this issue to access files outside of the checked-out     repository root. (CVE-2026-33748)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9a360acefb advisory.

    update to 1.154.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-853a2fa7e5 advisory.

    - Update to release v29.4.0
    - Resolves: rhbz#2455894
    - Resolves  CVE-2026-34986: rhbz#2455665
    - Upstream new features and fixes

    ----

    - Update to release v29.3.1
    - Resolves: rhbz#2451425
    - Upstream notes that this release resolves: CVE-2026-34040,       CVE-2026-33997, CVE-2026-33748, CVE-2026-33747
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Docker Engine installed on the remote host is prior to 29.3.1. It is therefore affected by multiple vulnerabilities:

  - CVE-2026-34040: AuthZ plugin authorization bypass vulnerability. Authorization plugins could be bypassed     under specific conditions, potentially allowing unauthorized access.

  - CVE-2026-33997: Plugin privilege validation bypass vulnerability in 'docker plugin install' command.
    A flaw in privilege validation could be partially bypassed, potentially leading to unauthorized privilege     escalation.

  - CVE-2026-33748: BuildKit Git URL validation vulnerability. Insufficient validation of Git URL '#ref:subdir'     fragments could allow access to files outside the intended repository scope, leading to unauthorized     information disclosure.

  - CVE-2026-33747: BuildKit arbitrary file write vulnerability. An untrusted frontend could cause files to be     written outside the BuildKit state directory, potentially allowing local privilege escalation or unauthorized     file writes.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components     may allow access to files outside the checked-out Git repository root. Possible access is limited to files     on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds     that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted     sources or using the subdir component from an untrusted Git repository where the subdir component could     point to a symlink. (CVE-2026-33748)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318012	Fedora 43 : docker-compose (2026-951a6725b8)	Nessus	Fedora Local Security Checks	high
317990	Fedora 44 : docker-compose (2026-3316f97296)	Nessus	Fedora Local Security Checks	high
317651	openSUSE 16 Security Update : docker-stable (openSUSE-SU-2026:20814-1)	Nessus	SuSE Local Security Checks	high
315638	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1671)	Nessus	Amazon Linux Local Security Checks	high
314759	Fedora 45 : docker-compose (2026-f5bc7ff320)	Nessus	Fedora Local Security Checks	high
314580	Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-117 (ALASDOCKER-2026-117)	Nessus	Amazon Linux Local Security Checks	high
313632	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20702-1)	Nessus	SuSE Local Security Checks	high
313210	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Docker vulnerabilities (USN-8230-1)	Nessus	Ubuntu Local Security Checks	high
310678	Fedora 44 : doctl (2026-9a360acefb)	Nessus	Fedora Local Security Checks	high
310540	Fedora 44 : moby-engine (2026-853a2fa7e5)	Nessus	Fedora Local Security Checks	high
304803	Docker Engine 29.3.1 Multiple Vulnerabilities	Nessus	Misc.	high
304339	Linux Distros Unpatched Vulnerability : CVE-2026-33748	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33748

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high