CVE-2026-54248: Doco-CD OCI Artifact Auth Bypass Vulnerability

CVE-2026-54248 Overview

CVE-2026-54248 is a trust-boundary flaw in doco-cd, a GitOps continuous delivery tool that deploys and updates Docker Compose projects and Swarm stacks. Versions prior to 0.90.1 allow artifact-provided deployment configuration to influence the policy used to verify that same Open Container Initiative (OCI) artifact. An attacker with write access to a configured OCI tag can publish an unsigned artifact containing .doco-cd.yml with oci.verify: false, bypassing global signature verification enabled through OCI_TRUST_POLICY. The flaw is classified as Improper Verification of Cryptographic Signature [CWE-347].

Critical Impact

Attackers with OCI tag write access can bypass signature verification and push untrusted deployment content that doco-cd will apply to managed environments.

Affected Products

• doco-cd versions prior to 0.90.1
• Deployments using OCI artifacts as the source for .doco-cd.yml configuration
• Poll or webhook flows without trusted inline deployment overrides

Discovery Timeline

• 2026-09-11 - CVE-2026-54248 published to the National Vulnerability Database (NVD)
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54248

Vulnerability Analysis

Doco-cd supports global OCI signature verification through the OCI_TRUST_POLICY setting. When enabled: true is configured, artifacts pulled from OCI registries should be cryptographically verified before deployment. The verification logic instead consumed the oci.verify field from .doco-cd.yml contained within the artifact itself. This created a circular trust relationship: the artifact under verification was permitted to declare that it required no verification. An attacker who could push to the tracked OCI tag could ship malicious Compose or Swarm manifests and set oci.verify: false inside the same artifact to disable the check.

Root Cause

The root cause is a violated trust boundary between artifact contents and verification policy. Configuration parsed from an untrusted, unverified artifact was granted authority to weaken the security policy applied to that artifact. The fix in version 0.90.1 treats artifact-contained .doco-cd.yml as untrusted for trust-policy override decisions and enforces no-downgrade behavior when global verification is enabled.

Attack Vector

Exploitation requires write or push access to the OCI repository and tag that doco-cd is configured to poll. The attacker publishes an artifact containing a crafted .doco-cd.yml that sets oci.verify: false along with malicious Compose or Swarm definitions. On the next poll or webhook trigger, doco-cd reads the embedded configuration, skips signature verification, and deploys the untrusted content to the target Docker or Swarm environment. This can lead to unauthorized container execution, secret exposure, and lateral movement within the deployment host. See the GitHub Security Advisory GHSA-5rv3-qpp3-6jp5 for full technical details.

Detection Methods for CVE-2026-54248

Indicators of Compromise

• Unexpected artifact digest changes on OCI tags monitored by doco-cd
• Presence of oci.verify: false in .doco-cd.yml files sourced from OCI artifacts
• Deployment events applied without corresponding successful signature verification log entries
• New or modified containers, volumes, or network bindings not tied to an approved release

Detection Strategies

• Audit doco-cd logs for verification skipped events when OCI_TRUST_POLICY.enabled is set to true
• Compare deployed artifact digests against a trusted release manifest maintained outside the artifact
• Alert on push events to OCI repositories used by doco-cd from identities outside the release pipeline

Monitoring Recommendations

• Forward doco-cd application logs and OCI registry audit logs to a centralized analytics platform
• Track container runtime activity on doco-cd managed hosts for anomalous process execution and outbound connections
• Correlate OCI tag mutations with change-management tickets to surface unauthorized publishes

How to Mitigate CVE-2026-54248

Immediate Actions Required

• Upgrade doco-cd to version 0.90.1 or later, which enforces the strict trust boundary and no-downgrade behavior
• Rotate any credentials or secrets that may have been exposed to untrusted deployments pushed during the vulnerable window
• Review all OCI repositories referenced by doco-cd for unauthorized artifacts and revert to known-good digests

Patch Information

The fix is available in doco-cd release v0.90.1. The remediation is implemented in Pull Request #1407. After patching, artifact-contained .doco-cd.yml files can no longer disable OCI signature verification when OCI_TRUST_POLICY.enabled is true.

Workarounds

• Do not source deployment configuration from untrusted OCI artifact contents; use trusted inline POLL_CONFIG.deployments instead
• Restrict write and push permissions on OCI repositories and tags consumed by doco-cd to release automation identities only
• Prefer immutable digest pinning and protected release or tag workflows over mutable tags
• Monitor for unexpected artifact digest changes and failed or suspicious verification events

# Configuration example - enforce global OCI trust policy and pin digests
OCI_TRUST_POLICY='{"enabled": true}'

# Prefer inline, trusted deployment configuration over artifact-provided config
POLL_CONFIG='{
  "deployments": [
    {
      "name": "app",
      "reference": "registry.example.com/app@sha256:<digest>"
    }
  ]
}'