CVE-2026-44218 — ciguard
LOWCVE-2026-44218 is a low-severity (CVSS 3) Improper Privilege Management vulnerability in ciguard. A fix is available for ciguard — see the affected versions and patch details below.
ciguard: Container image runs as root (no USER directive)
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44218.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
ciguardReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. ciguard is a static analyser with no need for root privileges; running as root inside a container makes any future container-runtime escape CVE more impactful than it needs to be.
Threat scenario
Defence-in-depth gap. Without a known container-runtime CVE in the chain, this finding is not directly exploitable. Recent runc CVEs (e.g. CVE-2024-21626) provided escape primitives that depended on host UID = container UID = 0 for full impact; with this fix, any future such escape primitive lands as a non-root user on the host.
Patch
- Dockerfile adds
RUN groupadd -r ciguard && useradd -r -g ciguard -d /home/ciguard -m -s /usr/sbin/nologin ciguard && chown -R ciguard:ciguard /reports /policies-mount /app. - Followed by
USER ciguardbefore theCMDdirective. - Trivy DS-0002 misconfig clears (
Tests: 20 SUCCESSES: 20 FAILURES: 0).
Discovery
Found by Trivy filesystem scan during ciguard's first self-conducted pentest cycle, 2026-04-26.
CVSS Scoring
- CVSS v3.1:
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N— 2.0 (Low) - CVSS v4.0:
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N— 3.4 (Low) per Cycle 1 report; GitHub's calc 1.8 (Low). Both Low.
Verification
$ docker run --rm ghcr.io/jo-jo98/ciguard:v0.8.2 id
uid=999(ciguard) gid=999(ciguard) groups=999(ciguard)
References
- Fix released in v0.8.2
- CI regression gate added in v0.8.3
- https://www.cve.org/CVERecord?id=CVE-2026-44218
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | ciguard | ≥ 0.1.0&&< 0.8.2 | 0.8.2pip install --upgrade 'ciguard==0.8.2' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ciguard, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ciguard to 0.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44218 is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Frequently Asked Questions
Is CVE-2026-44218 in your dependencies?
Find it across PyPI, including transitive dependencies.