Code Injection in docker (CVE-2026-42298)
Summary
code injection in docker (CVE-2026-42298). Successful exploitation can lead to full system takeover. Exploitable via GITHUB_TOKEN. Mitigation: upgrade to >= 0 or later.
Original description
The description as published by the source.
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.
Source: NIST National Vulnerability Database NVD
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
A vulnerability in the Postiz tool allowed attackers to gain full control over the source code, posing a significant risk. This has been addressed in the latest update. Similar issues have occurred in the past, where simple actions could lead to exploitation. Companies using this tool should take swift action.
The vulnerability in the Postiz tool in '.github/workflows/pr-docker-build.yml' allowed unauthenticated users to create a pull request from a fork with a malicious Dockerfile.dev, enabling arbitrary code execution during the Docker build process and exfiltration of a highly privileged GITHUB_TOKEN. This issue was resolved in commit 'da44801'.
Vulnerability allowed execution of arbitrary code and theft of a GITHUB_TOKEN with write-all permissions by creating a malicious pull request.
Workflow file '.github/workflows/pr-docker-build.yml' in Postiz app.
critical (CVSS v3: 10.0) - Remote code execution, no authentication required, highly privileged token compromised.
Upgrade to the version including commit da44801 or later.
No specific workaround mentioned.
No specific detection method mentioned.
Related past incidents Similar incidents extracted from past CVEs
Log4Shell: Similar RCE allowing code execution and access through malicious requests.
If this happens at your company Expected impact per business scenario
攻撃者は全てのソースコードにアクセスし、改ざんやデータ漏洩を引き起こせる。
内部システムの信頼性が失墜し、業務継続に影響が出る。
サービス停止やデータの不正利用に繋がる可能性がある。
直ちにコミットda44801を含む更新バージョンにアップデートし、セキュリティ監査を行うことが推奨されます。
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'docker' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
dockerを grep し、稼働しているサービス・バージョンを把握する。 -
2Match against affected range verify
Confirm if version satisfies `>= 0`Step 1 で見つかったバージョンが影響範囲
>= 0に該当するか照合。本番で稼働中ならインシデント扱い。 -
6Apply patch patch
Upgrade docker to >= 0ステージング環境で >= 0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。
-
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。