CVE-2026-28407: Chainguard Malcontent Info Disclosure Flaw

CVE-2026-28407 Overview

CVE-2026-28407 is a security vulnerability in Chainguard Malcontent, a software tool designed for discovering supply-chain compromises through context, differential analysis, and YARA rules. Prior to version 1.21.0, malcontent would remove nested archives that failed to extract, which could potentially allow malicious content to evade scanning. This improper handling of exceptional conditions represents a gap in the security scanning coverage that the tool is designed to provide.

Critical Impact

Malicious content embedded within nested archives that fail extraction could bypass security scanning, potentially allowing supply-chain compromises to go undetected.

Affected Products

• Chainguard Malcontent versions prior to 1.21.0

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-28407 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-28407

Vulnerability Analysis

This vulnerability is classified under CWE-703 (Improper Check or Handling of Exceptional Conditions). The core issue lies in how malcontent handled nested archives that encountered extraction errors. When an archive failed to extract properly, the software would delete the archive file entirely rather than retaining it for analysis. This behavior created a blind spot in the scanning process where malicious payloads could be deliberately packaged in ways that cause extraction failures, effectively bypassing the security analysis that malcontent is designed to perform.

The attack vector is network-based, as malicious archives could be distributed through package repositories, download links, or supply-chain artifacts that malcontent would typically analyze.

Root Cause

The root cause stems from the archive handling logic in pkg/archive/archive.go. When extraction failed, the code would log a debug message and then unconditionally remove the archive file using os.Remove(fullPath). This approach assumed that failed-to-extract archives had no value for security analysis, when in reality these archives could still contain identifiable malicious patterns that YARA rules or byte-level analysis could detect.

Attack Vector

An attacker could craft a malicious nested archive designed to trigger extraction failures while containing malicious code or indicators of compromise. By exploiting edge cases in archive formats (corrupted headers, unsupported compression methods, or deliberately malformed structures), the attacker could ensure the archive fails to extract and is subsequently deleted without being scanned. This allows the malicious content to persist in the analyzed software package without detection.

// Security patch from pkg/archive/archive.go
// Source: https://github.com/chainguard-dev/malcontent/commit/356c56659ccfcad0b249a97de8cf71f151ed3ee9

 		if c.ExitExtraction {
 			return fmt.Errorf("failed to extract archive: %w", err)
 		}
-		logger.Debugf("ignoring extraction error for %s: %s", f, err.Error())
+		logger.Warnf("extraction failed for %s, retaining archive for scanning: %s", f, err.Error())
 	}
 
 	extracted.Store(f, true)
 
-	if err := os.Remove(fullPath); err != nil {
-		return fmt.Errorf("failed to remove archive file: %w", err)
+	// only attempt to remove the archive file if we don't encounter an extraction error
+	// any archives which cannot be extracted will be scanned like non-archive files
+	if err == nil {
+		if err := os.Remove(fullPath); err != nil {
+			return fmt.Errorf("failed to remove archive file: %w", err)
+		}
 	}
 
 	entries, err := os.ReadDir(d)

The fix ensures that archives which fail extraction are preserved and scanned as regular files, providing best-effort analysis of the archive bytes even when full extraction is not possible.

Detection Methods for CVE-2026-28407

Indicators of Compromise

• Presence of malcontent versions prior to 1.21.0 in CI/CD pipelines or security tooling
• Debug logs showing "ignoring extraction error" messages for archives that were subsequently deleted
• Nested archives with unusual or malformed structures in scanned software packages

Detection Strategies

• Review malcontent logs for extraction failure patterns that may indicate attempted evasion
• Audit software packages for nested archives with deliberate corruption or edge-case formatting
• Compare scan results between vulnerable and patched versions of malcontent to identify previously missed detections

Monitoring Recommendations

• Monitor for extraction failures during malcontent scans and investigate patterns in failed archives
• Implement secondary scanning tools to provide defense-in-depth for supply-chain analysis
• Track version deployments of malcontent across security infrastructure to ensure patched versions are in use

How to Mitigate CVE-2026-28407

Immediate Actions Required

• Upgrade Chainguard Malcontent to version 1.21.0 or later immediately
• Re-scan previously analyzed software packages with the patched version to identify any missed detections
• Review scan history for archives that may have failed extraction and were deleted without analysis

Patch Information

The vulnerability is fixed in Chainguard Malcontent version 1.21.0. The fix is implemented in commit 356c56659ccfcad0b249a97de8cf71f151ed3ee9 via Pull Request #1383. For detailed information, refer to the GitHub Security Advisory GHSA-945p-3jhm-6rcp.

Workarounds

• Configure malcontent with ExitExtraction enabled to fail-fast on extraction errors rather than silently deleting problematic archives
• Implement a pre-processing step to retain copies of all archives before malcontent analysis
• Use complementary scanning tools alongside malcontent to provide coverage for archive content

# Verify malcontent version and upgrade if necessary
malcontent --version
# Ensure version is 1.21.0 or later

# For container deployments, pull the latest image
docker pull cgr.dev/chainguard/malcontent:latest