Docker Compose: attacker-controlled paths in OCI compose artifacts overwrite arbitrary files on the host

Impact

Compose trusts the com.docker.compose.file and com.docker.compose.envfile annotations in a remote OCI artifact and joins the attacker-supplied value with its local cache directory before writing, so a malicious artifact escapes the cache and overwrites any file the invoking user can write. The dangerous part for a fleet is that read-only commands trigger it: docker compose config or docker compose ps is enough, no up required. That makes CI/CD runners and cloud dev environments that resolve third-party compose artifacts the real exposure - a runner that merely inspects an artifact can have its own tooling, SSH keys or next-stage scripts rewritten, which is a supply-chain foothold into whatever that runner deploys to the GPU fleet.

Who can reach it

Anyone who can get a host to run docker compose against an OCI compose artifact they control - a pull-request pipeline, a shared registry, or a developer following a published reference. Requires the operator to invoke Compose on the artifact; no authentication to the host.

What to do

Upgrade Docker Compose to v2.40.2 or later on every host and CI runner that resolves remote compose artifacts - a binary or Docker Desktop update, no service restart or reboot. Until runners are updated, stop resolving compose artifacts from registries you do not control, including in read-only inspection steps.

References

Related entries

• Argo Workflows (controller, podSpecPatch in Strict/Secure template reference mode): A podSpecPatch on the submittedCVE-2026-31892 · Argo Workflows (controller, podSpecPatch in Strict/Secure template reference mode)High
• Argo Workflows (controller, ArtifactGC.PodSpecPatch / template reference allow-list): The allow-list that is supposedCVE-2026-54526 · Argo Workflows (controller, ArtifactGC.PodSpecPatch / template reference allow-list)High
• CRI-O: Ambient-capability mishandling runs containers with elevated privilegesCVE-2018-1000400 · CRI-OHigh
• Harbor: Privilege escalation in the Harbor registryCVE-2019-19023 · HarborHigh
• Rancher: Incorrectly applied authorization check lets a namespace be moved into a different projectCVE-2020-10676 · RancherHigh
• Kubernetes (kubelet): subPath volume mount symlink race gives access to host files and directories outside the volumeCVE-2021-25741 · Kubernetes (kubelet)High