CVE-2026-66384

The 'specific remote-repository conditions' qualifier in this CVE is the detail that deserves your attention. It signals a context-dependent path traversal where the trigger conditions aren't fully disclosed — and that should concern you more than the medium CVSS score suggests. The authenticated-user prerequisite is being framed as a limiting factor, but in container ecosystems, authentication to registries is the default operational state, not an elevated privilege. Developers authenticate to pull base images, push builds, and sync dependencies routinely. The real question isn't whether an authenticated user can write outside the cache path — it's whether the cache boundary was ever a meaningful security boundary under normal operation. The evidence suggests it wasn't. This vulnerability is better understood as a supply-chain persistence mechanism than a direct code execution vector. In shared CI/CD environments — which are the norm — cache contamination survives the transaction and propagates horizontally to other jobs, other developers, other pipelines. One compromised credential or poisoned build step writes payloads into cache paths that subsequent pipeline stages load as trusted. That's a different damage profile than the CVSS captures. The low EPSS score (0.00264) likely reflects poor exploitability in the wild rather than low consequence if exploited. Specific trigger conditions create a targeted weapon rather than spray-and-pray opportunity. However, the historical pattern with Docker cache vulnerabilities shows that undisclosed trigger conditions often overlap with common registry configurations in production — particularly with deprecated API paths, legacy mirrors, or pinned Docker versions that won't see the patch for months or years. Check your CI/CD pipeline: Are developers running pinned Docker versions? Do you use private registry mirrors or legacy authentication flows? These are the configurations where the 'specific conditions' likely still trigger. Treat cache integrity as untrusted in any pipeline where authentication is default — because that's what this CVE is really telling you.

Reviewed through automated stages and approved by a human before publication.