6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pv22-fqcj-7xwh

GHSA-pv22-fqcj-7xwh: Inspektor Gadget Security Policies Can be Bypassed

Security policies like allowed-gadgets, disallow-pulling, verify-image can be bypassed by a malicious client.

Impact

Users running ig in daemon mode or IG on Kubernetes that rely on any of the features mentioned above are vulnerable to this issue. In order to exploit this, the client needs access to the server, like the correct TLS certificates on the ig daemon case or access to the cluster in the Kubernetes case.

Patches

The issue has been fixed in v0.40.0

Workarounds

There is not known workaround to fix it.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pv22-fqcj-7xwh

GHSA-pv22-fqcj-7xwh:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/inspektor-gadget/inspektor-gadget	go	>= 0.31.0, < 0.40.0	0.40.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed bypassing security policies (allowed-gadgets, disallow-pulling, verify-image) because client-supplied instance parameters could override global security parameters. The patch c51d419964f5b6f9344fcad4faba70e2e025212b in pkg/operators/oci-handler/oci.go addresses this.

The function (*ociHandler).InstantiateDataOperator was responsible for preparing parameters. In its vulnerable state, it merged instance parameters (from instanceParamValues, potentially client-controlled) into a common ociParams structure that also held global parameters. The CopyFromMap operation allowed instance parameters to overwrite global ones if they shared the same key. This is where the malicious input (instanceParamValues) could effectively alter security settings.
The function (*OciHandlerInstance).init then used this ociParams structure to make decisions based on security policies (e.g., checking disallowPulling, verifyImage). Because ociParams could contain overridden values, the security checks were performed against the client-manipulated settings, not the intended global policies.

The patch rectifies this by ensuring globalParams and instanceParams are handled separately throughout the OciHandlerInstance lifecycle. Security-critical parameters are now explicitly read from globalParams in the init method, preventing instance parameters from overriding them. The identified functions are the ones directly involved in the flawed parameter handling (InstantiateDataOperator) and the consumption of these flawed parameters for security decisions (init).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-pv22-fqcj-7xwh: Inspektor Gadget Security Policies Can be Bypassed

Impact

Patches

Workarounds

GHSA-pv22-fqcj-7xwh:

6.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

6.7

6.7

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

GHSA-pv22-fqcj-7xwh: Inspektor Gadget Security Policies Can be Bypassed

Impact

Patches

Workarounds

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI