Homepage

Improper Input Validation Affecting trivy-operator-fips package, versions <0.33.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.36% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-TRIVYOPERATORFIPS-19161761
  • published22 Aug 2026
  • disclosed19 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Aug 2026

NewCVE-2026-61711  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade Minimos:latest trivy-operator-fips to version 0.33.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream trivy-operator-fips package and not the trivy-operator-fips package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.