StackRadar

CVE-2023-26054

Medium

Advisory

Published 7 Mar 2023In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.010
62nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
17
of 17,781 indexed, latest versions
Container images
10
deployed by those charts
Fix available
1 of 1
affected package

Buildkit credentials inlined to Git URLs could end up in provenance attestation

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 10 images.

Affected packageAffected versionsFixed inImages
github.com/moby/buildkitgolangv0.10.1-0.20220403220257-10e6f94bf90d, v0.10.1-0.20220816171719-55ba9d14360a, v0.10.3, v0.10.4+3 more0.11.410
OSV records
GHSA-gc89-7gcr-jxqc

Charts affected

17 by stars
ChartLatestAffected imagesRadar Score
drone-runner-dockerdroneVerified publisher0.7.01 of 3See more

drone-runner-docker drone 0.7.0

1 of the 3 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
library/docker:20-dindaf96c680a7e1
github.com/moby/buildkit@v0.11.2
0.11.4

Open the chart page →

5,674
feedbacksystemthm-mni-iiVerified publisher0.47.12 of 10See more

feedbacksystem thm-mni-ii 0.47.1

2 of the 10 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
library/docker:20.10.21-dind3153fa63f546
github.com/moby/buildkit@v0.10.1-0.20220816171719-55ba9d14360a
0.11.4
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/moby/buildkit@v0.11.2
0.11.4

Open the chart page →

28,534
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/moby/buildkit@v0.11.0
0.11.4

Open the chart page →

5,598
docker-in-dockerdocker-in-docker0.0.31 of 2See more

docker-in-docker docker-in-docker 0.0.3

1 of the 2 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
library/docker:24.0.2-dind1d148deae16a
github.com/moby/buildkit@v0.11.0-rc3.0.20230609092854-67a08623b95a
0.11.4

Open the chart page →

2,576
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

4,547
kafkagengxiankun-charts0.2.01 of 1See more

kafka gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

4,547
helm-airportshelm-airports0.1.01 of 7See more

helm-airports helm-airports 0.1.0

1 of the 7 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

12,696
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

4,547
helm-airportshelm-airports-dan0.1.01 of 7See more

helm-airports helm-airports-dan 0.1.0

1 of the 7 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

5,573
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

4,547
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/moby/buildkit@v0.10.3
0.11.4

Open the chart page →

17,798
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/moby/buildkit@v0.10.4
0.11.4

Open the chart page →

4,271
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
github.com/moby/buildkit@v0.11.2
0.11.4

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
github.com/moby/buildkit@v0.11.2
0.11.4

Open the chart page →

10,603
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

4,547
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
linuxserver/cloud9:latest45c5fe102ff3
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4

Open the chart page →

27,465
openvscode-serveropenvscode-server-helmVerified publisher2.7.371 of 2See more

openvscode-server openvscode-server-helm 2.7.37

1 of the 2 container images this version deploys carry CVE-2023-26054.

Container imageDigestPackageFixed in
library/docker:23.0.1-dindd9a0fd8bdd15
github.com/moby/buildkit@v0.11.2
0.11.4

Open the chart page →

4,237

Container images carrying it

10 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4
7
library/docker:20.10-dind:20-dindaf96c680a7e1
github.com/moby/buildkit@v0.11.2
0.11.4
3
aquasec/trivy:0.32.0973d0df16189
github.com/moby/buildkit@v0.10.4
0.11.4
1
devopstales/trivy-operator:2.575136aa7a26e
github.com/moby/buildkit@v0.11.0
0.11.4
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/moby/buildkit@v0.10.3
0.11.4
1
library/docker:24.0.2-dind1d148deae16a
github.com/moby/buildkit@v0.11.0-rc3.0.20230609092854-67a08623b95a
0.11.4
1
library/docker:20.10.21-dind3153fa63f546
github.com/moby/buildkit@v0.10.1-0.20220816171719-55ba9d14360a
0.11.4
1
library/docker:23.0.1-dindd9a0fd8bdd15
github.com/moby/buildkit@v0.11.2
0.11.4
1
linuxserver/cloud9:latest45c5fe102ff3
github.com/moby/buildkit@v0.10.1-0.20220403220257-10e6f94bf90d
0.11.4
1
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/moby/buildkit@v0.11.2
0.11.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.