Detections
Analytics

SCA: security update for github.com/inspektor-gadget/inspektor-gadget (GHSA-7cfq-5mhv-jrp9)

medium Tenable Self-Hosted Container Security Plugin ID 443761

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes
 clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in
 pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the
 privileged Inspektor Gadget process when a custom gadget containing a SEC("usdt/...") eBPF section
 attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without
 validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice
 operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume
 gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed
 ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only
 deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service
 rather than code execution or privilege escalation. This issue is fixed in version 0.53.1.
 (CVE-2026-44778)

Solution

Update the github.com/inspektor-gadget/inspektor-gadget library and its related packages to version 0.53.1 or later.

See Also

https://github.com/advisories/GHSA-7cfq-5mhv-jrp9

Plugin Details

Severity: Medium

ID: 443761

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/23/2026

Updated: 9/16/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-44778

CVSS v3

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 2.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/22/2026

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-44778

cwe: CWE-20