Skip to main content
Testkube 2.10.0 is out! Granular Metrics, AI MCP improvements, Organization management, and much more. Read More

testkube-tw-toolkit-2.10.0_linux_arm64

digestsha256:1824bba0a240693981fd9beab7ff385f069b709babe2a048faa16049f16aa364
vulnerabilitiescritical: 9 high: 13 medium: 20 low: 4
platformlinux/arm64
size49 MB
packages217
critical: 7 high: 2 medium: 4 low: 0 golang.org/x/crypto 0.51.0 (golang)

pkg:golang/golang.org/x/crypto@0.51.0

# tw-toolkit.Dockerfile (28:28)
COPY --from=build /app/testworkflow-init /init

critical : CVE--2026--46595

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.052%
EPSS Percentile16th percentile
Description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

critical : CVE--2026--42508

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.038%
EPSS Percentile12th percentile
Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

critical : CVE--2026--39834

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.054%
EPSS Percentile17th percentile
Description

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

critical : CVE--2026--39833

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.042%
EPSS Percentile13th percentile
Description

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

critical : CVE--2026--39832

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.068%
EPSS Percentile21st percentile
Description

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

critical : CVE--2026--39831

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.029%
EPSS Percentile9th percentile
Description

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

critical : CVE--2026--39830

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.055%
EPSS Percentile17th percentile
Description

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

high : CVE--2026--46597

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.054%
EPSS Percentile17th percentile
Description

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

high : CVE--2026--39829

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.088%
EPSS Percentile25th percentile
Description

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

medium : CVE--2026--39827

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.023%
EPSS Percentile7th percentile
Description

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

medium : CVE--2026--39828

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.030%
EPSS Percentile9th percentile
Description

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

medium : CVE--2026--46598

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.050%
EPSS Percentile16th percentile
Description

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

medium : CVE--2026--39835

Affected range<0.52.0
Fixed version0.52.0
EPSS Score0.029%
EPSS Percentile9th percentile
Description

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

critical: 1 high: 5 medium: 1 low: 0 libssl3 3.5.5-r0 (apk)

pkg:apk/alpine/libssl3@3.5.5-r0?arch=aarch64&distro=alpine-3.23.3&upstream=openssl

# tw-toolkit.Dockerfile (24:24)
FROM ${ALPINE_IMAGE}

critical : CVE--2026--31789

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.007%
EPSS Percentile1st percentile
Description

high : CVE--2026--28387

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.044%
EPSS Percentile14th percentile
Description

high : CVE--2026--31790

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.042%
EPSS Percentile13th percentile
Description

high : CVE--2026--28390

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.140%
EPSS Percentile34th percentile
Description

high : CVE--2026--28389

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.113%
EPSS Percentile30th percentile
Description

high : CVE--2026--28388

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.045%
EPSS Percentile14th percentile
Description

medium : CVE--2026--2673

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.023%
EPSS Percentile7th percentile
Description
critical: 1 high: 0 medium: 5 low: 0 golang.org/x/net 0.54.0 (golang)

pkg:golang/golang.org/x/net@0.54.0

# tw-toolkit.Dockerfile (28:28)
COPY --from=build /app/testworkflow-init /init

critical : CVE--2026--39821

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.050%
EPSS Percentile16th percentile
Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

medium : CVE--2026--25680

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.061%
EPSS Percentile19th percentile
Description

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

medium : CVE--2026--42506

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.032%
EPSS Percentile10th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--42502

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.031%
EPSS Percentile9th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--27136

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.031%
EPSS Percentile9th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--25681

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.031%
EPSS Percentile9th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

critical: 0 high: 2 medium: 6 low: 0 libcurl 8.19.0-r0 (apk)

pkg:apk/alpine/libcurl@8.19.0-r0?arch=aarch64&distro=alpine-3.23.3&upstream=curl

# tw-toolkit.Dockerfile (25:25)
RUN apk --no-cache add ca-certificates libssl3 git openssh-client

high : CVE--2026--6276

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.013%
EPSS Percentile2nd percentile
Description

high : CVE--2026--5773

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.019%
EPSS Percentile5th percentile
Description

medium : CVE--2026--5545

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.037%
EPSS Percentile11th percentile
Description

medium : CVE--2026--6253

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile9th percentile
Description

medium : CVE--2026--4873

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.014%
EPSS Percentile3rd percentile
Description

medium : CVE--2026--7168

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.079%
EPSS Percentile23rd percentile
Description

medium : CVE--2026--7009

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.013%
EPSS Percentile2nd percentile
Description

medium : CVE--2026--6429

Affected range<=8.19.0-r0
Fixed versionNot Fixed
EPSS Score0.021%
EPSS Percentile6th percentile
Description
critical: 0 high: 1 medium: 1 low: 3 openssh-keygen 10.2_p1-r0 (apk)

pkg:apk/alpine/openssh-keygen@10.2_p1-r0?arch=aarch64&distro=alpine-3.23.3&upstream=openssh

# tw-toolkit.Dockerfile (25:25)
RUN apk --no-cache add ca-certificates libssl3 git openssh-client

high : CVE--2026--35385

Affected range<=10.2_p1-r0
Fixed versionNot Fixed
EPSS Score0.058%
EPSS Percentile18th percentile
Description

medium : CVE--2026--35414

Affected range<=10.2_p1-r0
Fixed versionNot Fixed
EPSS Score0.031%
EPSS Percentile9th percentile
Description

low : CVE--2026--35386

Affected range<=10.2_p1-r0
Fixed versionNot Fixed
EPSS Score0.034%
EPSS Percentile11th percentile
Description

low : CVE--2026--35387

Affected range<=10.2_p1-r0
Fixed versionNot Fixed
EPSS Score0.052%
EPSS Percentile17th percentile
Description

low : CVE--2026--35388

Affected range<=10.2_p1-r0
Fixed versionNot Fixed
EPSS Score0.015%
EPSS Percentile3rd percentile
Description
critical: 0 high: 1 medium: 1 low: 0 musl 1.2.5-r21 (apk)

pkg:apk/alpine/musl@1.2.5-r21?arch=aarch64&distro=alpine-3.23.3

# tw-toolkit.Dockerfile (24:24)
FROM ${ALPINE_IMAGE}

high : CVE--2026--40200

Affected range<1.2.5-r23
Fixed version1.2.5-r23
EPSS Score0.020%
EPSS Percentile6th percentile
Description

medium : CVE--2026--6042

Affected range<1.2.5-r22
Fixed version1.2.5-r22
EPSS Score0.007%
EPSS Percentile0th percentile
Description
critical: 0 high: 1 medium: 0 low: 0 github.com/docker/cli 29.4.3+incompatible (golang)

pkg:golang/github.com/docker/cli@29.4.3%2Bincompatible

# tw-toolkit.Dockerfile (28:28)
COPY --from=build /app/testworkflow-init /init

high : CVE--2025--15558

Affected range>=19.03.0+incompatible
Fixed versionNot Fixed
EPSS Score0.023%
EPSS Percentile7th percentile
Description

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

critical: 0 high: 1 medium: 0 low: 0 git 2.52.0-r0 (apk)

pkg:apk/alpine/git@2.52.0-r0?arch=aarch64&distro=alpine-3.23.3

# tw-toolkit.Dockerfile (25:25)
RUN apk --no-cache add ca-certificates libssl3 git openssh-client

high : CVE--2025--66413

Affected range<=2.52.0-r0
Fixed versionNot Fixed
EPSS Score0.058%
EPSS Percentile18th percentile
Description
critical: 0 high: 0 medium: 1 low: 1 zlib 1.3.1-r2 (apk)

pkg:apk/alpine/zlib@1.3.1-r2?arch=aarch64&distro=alpine-3.23.3

# tw-toolkit.Dockerfile (24:24)
FROM ${ALPINE_IMAGE}

medium : CVE--2026--22184

Affected range<1.3.2-r0
Fixed version1.3.2-r0
EPSS Score0.008%
EPSS Percentile1st percentile
Description

low : CVE--2026--27171

Affected range<1.3.2-r0
Fixed version1.3.2-r0
EPSS Score0.009%
EPSS Percentile1st percentile
Description
critical: 0 high: 0 medium: 1 low: 0 ssl_client 1.37.0-r30 (apk)

pkg:apk/alpine/ssl_client@1.37.0-r30?arch=aarch64&distro=alpine-3.23.3&upstream=busybox

# tw-toolkit.Dockerfile (24:24)
FROM ${ALPINE_IMAGE}

medium : CVE--2025--60876

Affected range<=1.37.0-r30
Fixed versionNot Fixed
EPSS Score0.051%
EPSS Percentile16th percentile
Description