Executive brief
ciguard is a static security analysis tool used to audit CI/CD pipelines. A configuration issue in its container image allows the application to run with administrative (root) privileges, which is unnecessary for its function. If a separate security flaw were discovered in the container software itself, this configuration would make it easier for an attacker to escape the container and gain control over the underlying host system.
Technical details
The ciguard container image (ghcr.io/jo-jo98/ciguard) lacks a USER directive in its Dockerfile, causing the process to inherit default root privileges (UID 0). While not directly exploitable on its own, this represents a failure in the principle of least privilege and a defense-in-depth gap. In the event of a container runtime escape vulnerability (such as those affecting runc), the impact is significantly increased because the escaped process would maintain root privileges on the host system. The vulnerability was identified via a Trivy filesystem scan and has been remediated by creating a dedicated non-privileged user and group within the Dockerfile. The fix is available in version 0.8.2.
Affected products
- Jo-Jo98 ciguard >= 0.1.0, <= 0.8.1
Timeline
- 2026-04-26: disclosed: Identified during internal pentest cycle.
- 2026-04-26: patched: Fix released in version 0.8.2.
- 2026-05-05: advisory: GitHub Advisory published.