ciguard: Container image runs as root (no USER directive)
Summary
The published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. ciguard is a static analyser with no need for root privileges; running as root inside a container makes any future container-runtime escape CVE more impactful than it needs to be.
Threat scenario
Defence-in-depth gap. Without a known container-runtime CVE in the chain, this finding is not directly exploitable. Recent runc CVEs (e.g. CVE-2024-21626) provided escape primitives that depended on host UID = container UID = 0 for full impact; with this fix, any future such escape primitive lands as a non-root user on the host.
Patch
- Dockerfile adds
RUN groupadd -r ciguard && useradd -r -g ciguard -d /home/ciguard -m -s /usr/sbin/nologin ciguard && chown -R ciguard:ciguard /reports /policies-mount /app. - Followed by
USER ciguardbefore theCMDdirective. - Trivy DS-0002 misconfig clears (
Tests: 20 SUCCESSES: 20 FAILURES: 0).
Discovery
Found by Trivy filesystem scan during ciguard's first self-conducted pentest cycle, 2026-04-26.
CVSS Scoring
- CVSS v3.1:
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N— 2.0 (Low) - CVSS v4.0:
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N— 3.4 (Low) per Cycle 1 report; GitHub's calc 1.8 (Low). Both Low.
Verification
$ docker run --rm ghcr.io/jo-jo98/ciguard:v0.8.2 id
uid=999(ciguard) gid=999(ciguard) groups=999(ciguard)References
- Fix released in v0.8.2
- CI regression gate added in v0.8.3
- https://www.cve.org/CVERecord?id=CVE-2026-44218
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ciguard | >= 0.1.0, < 0.8.2 | 0.8.2 |
References
- https://github.com/Jo-Jo98/ciguard/security/advisories/GHSA-jrm4-4pcf-4763
- https://nvd.nist.gov/vuln/detail/CVE-2026-44218
- https://github.com/Jo-Jo98/ciguard
- https://github.com/Jo-Jo98/ciguard/releases/tag/v0.8.2
- https://github.com/Jo-Jo98/ciguard/releases/tag/v0.8.3
- https://pypi.org/project/ciguard
- https://github.com/advisories/GHSA-jrm4-4pcf-4763
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-269- Platform
- Python (PyPI)
- Package
ciguard- Disclosed
- 05.05.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2409 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-jrm4-4pcf-4763 - CC BY 4.0
Vulnerability history: ciguard
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 05.2026 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 1
- Low 3
Disclosures per year
- 2026: 4
-
ciguard: Container image runs as root (no USER directive) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.