Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

containernetworking/plugins

              main @ 33cc6bd
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Incorrect File Permissions: 1 prior fix. Scrutinize any change in this area.

plugins/ipam/host-local/backend/disk: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Network Configuration: The portmap plugin's nftables backend incorrectly intercepted and DNATed non-local transit traffic due to a missing fib lookup. This allowed accidental exposure or hijacking of routing paths, requiring explicit destination type validations.

Incorrect File Permissions: Host-local IPAM plugin state files were created with world-readable permissions (0644), exposing allocated IP address assignments and metadata to unauthorized local users. Restricting these files to 0600 is critical to preventing local information disclosure.