CVE-2026-44220: ciguard Path Traversal Vulnerability

CVE-2026-44220 Overview

CVE-2026-44220 affects ciguard, a static security auditor for CI/CD pipelines. The flaw resides in the discover_pipeline_files() function inside src/ciguard/discovery.py. The function walks a directory tree while following symbolic links, relying only on resolved-path tracking to prevent cycles. An attacker who plants a symlink in a directory scanned by a user or AI agent can redirect discovery outside the requested root. The scan then returns pipeline-shaped files from unintended locations. The issue affects versions 0.8.0 and 0.8.1 and is fixed in 0.8.2. This is a symlink-following vulnerability classified under [CWE-59].

Critical Impact

Attackers can manipulate ciguard scans to read and report on pipeline files outside the intended scan root, undermining audit integrity.

Affected Products

• ciguard 0.8.0
• ciguard 0.8.1
• Fixed in ciguard 0.8.2

Discovery Timeline

• 2026-05-12 - CVE-2026-44220 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44220

Vulnerability Analysis

The discover_pipeline_files() function recursively walks a target directory to identify CI/CD pipeline definition files. During traversal, the function follows symbolic links it encounters. Cycle protection is implemented by tracking already-visited resolved paths, but this control only prevents infinite loops. It does not constrain traversal to the originally requested root directory.

When the walker encounters a symlink pointing outside the scan root, it resolves the link and continues walking the target. Any pipeline-shaped files discovered along that path are returned to the caller as if they belonged to the scanned project. The caller, whether a human auditor or an automated AI agent, then processes those external files as legitimate pipeline definitions.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. The discovery routine treats symlink targets as in-scope without verifying that the resolved path remains within the user-specified root. The visited-set check addresses traversal cycles but not boundary enforcement.

Attack Vector

Exploitation requires local access with permission to create a symlink inside a directory that ciguard will scan. The attacker plants a symlink pointing to a sensitive directory or attacker-controlled location containing crafted pipeline files. When the victim runs ciguard against the parent directory, discovery follows the symlink and returns out-of-root paths. The downstream auditor or AI agent then ingests attacker-influenced content, with user interaction required to initiate the scan.

No verified public proof-of-concept exploit is available. See the GitHub Security Advisory for additional technical detail.

Detection Methods for CVE-2026-44220

Indicators of Compromise

• Symbolic links present inside repositories or working directories immediately before a ciguard invocation, particularly links resolving outside the project root.
• ciguard output containing absolute paths or paths outside the expected scan root.
• Unexpected pipeline files (for example .github/workflows/*.yml, .gitlab-ci.yml) reported from directories the project does not own.

Detection Strategies

• Audit shell and CI logs for ciguard runs against versions 0.8.0 or 0.8.1 and correlate with filesystem changes that introduced symlinks.
• Compare the file list returned by ciguard against the canonical set of pipeline files tracked in version control to identify out-of-tree entries.
• Run filesystem integrity checks (for example find <root> -type l) before invoking the auditor to enumerate symlinks within scan targets.

Monitoring Recommendations

• Monitor developer workstations and CI runners for symlink creation events inside repository working trees.
• Log the resolved paths emitted by static analysis tooling and alert on paths that exit the project root.
• Track installed versions of ciguard across build infrastructure to flag pinned versions below 0.8.2.

How to Mitigate CVE-2026-44220

Immediate Actions Required

• Upgrade ciguard to version 0.8.2 or later on all developer workstations, CI runners, and AI agent environments.
• Inventory existing repositories and scan targets for unexpected symbolic links and remove or quarantine them.
• Restrict write access to directories that automated agents will scan to trusted users only.

Patch Information

The maintainers fixed the issue in ciguard 0.8.2. The patched release constrains discovery so that resolved symlink targets outside the requested root are not returned. Refer to the GitHub Security Advisory GHSA-8cxw-cc62-q28v for release notes and commit details.

Workarounds

• Run ciguard only against directories under exclusive control of trusted users until the upgrade is applied.
• Pre-scan target directories and remove symbolic links before invoking the auditor.
• Execute ciguard inside a sandbox or container with read-only mounts limited to the intended scan root to prevent traversal into external paths.

# Configuration example: upgrade and pre-scan symlinks before audit
pip install --upgrade 'ciguard>=0.8.2'
find ./project -type l -print
ciguard ./project