Description

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`. This could cause signature verification to be bypassed and untrusted deployment content to be applied. This primarily impacts users deploying from OCI artifacts where deployment config is read from artifact contents (for example, poll/webhook flows without trusted inline deployment overrides). The issue is fixed by enforcing a strict trust boundary and no-downgrade behavior. First, artifact-contained `.doco-cd.yml` is treated as untrusted for OCI trust-policy override decisions. Second, if global `OCI_TRUST_POLICY.enabled` is `true`, per-deployment `oci.verify: false` cannot disable verification. Some workarounds are available. Do not source deployment config from untrusted OCI artifact contents. Use trusted inline `POLL_CONFIG.deployments` and avoid relying on artifact-contained trust-policy overrides. Restrict write/push permissions for OCI repositories/tags used by doco-cd. Prefer immutable digest pinning and protected release/tag workflows. Monitor for unexpected artifact digest changes and failed/suspicious verification events.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T22:16:38.353Z",
  "pubdate": "2026-09-11T22:16:38.353Z",
  "executiveSummary": "Doco-CD versions prior to 0.90.1 contain a critical trust-boundary vulnerability in the OCI artifact verification process.\nThe vulnerability allows an attacker with write access to an OCI repository to bypass global signature verification requirements.\nBy embedding a malicious '.doco-cd.yml' configuration file within an OCI artifact, an attacker can override the 'OCI_TRUST_POLICY' settings, effectively disabling security checks for that specific deployment.\nThis failure creates a scenario where untrusted, potentially malicious deployment content can be executed in a environment that otherwise mandates strict OCI signature verification.\nThe risk is high for users relying on automated deployment flows, such as polls or webhooks, where the tool reads configuration directly from the OCI artifact.\nExploitation requires an attacker to possess write/push permissions for the OCI registry or tag being monitored by Doco-CD.\nThe primary impact is the unauthorized execution of arbitrary deployment configurations, potentially leading to container breakout or remote code execution within the cluster orchestration layer.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient trust boundary between the external OCI artifact content and the internal security policy enforcement engine in Doco-CD versions prior to 0.90.1.\nDoco-CD evaluates deployment configurations by parsing the '.doco-cd.yml' file contained within the OCI artifact. Under the vulnerable implementation, the application allowed the artifact to define its own verification parameters via an 'oci.verify' key.\nWhen 'OCI_TRUST_POLICY.enabled' is set to 'true' at the global level, Doco-CD is intended to enforce signature verification for all artifacts. However, the logic failed to treat the artifact's internal configuration as untrusted input. Consequently, a malicious actor can supply a crafted '.doco-cd.yml' containing 'oci.verify: false'.\nThe attack flow follows these steps: 1) The attacker gains write access to an OCI repository monitored by the Doco-CD instance. 2) The attacker crafts a malicious Docker Compose or Swarm stack configuration. 3) The attacker includes a '.doco-cd.yml' file within the OCI artifact that explicitly sets 'oci.verify: false'. 4) The attacker publishes this unsigned or improperly signed artifact to the registry. 5) Doco-CD initiates a pull/poll event for the updated artifact. 6) Doco-CD parses the internal configuration, identifies the 'oci.verify: false' directive, and subsequently honors this override, thereby bypassing the global mandatory signature verification check. 7) The malicious deployment content is applied to the target environment.\nThis vulnerability highlights a critical failure in the Principle of Least Privilege regarding configuration provenance. By allowing the artifact to influence the security policy used to verify itself, the system enables a 'confused deputy' scenario where the verification mechanism trusts the very entity it is designed to audit.\nThe fix introduced in version 0.90.1 enforces a strict trust boundary. First, it explicitly ignores 'oci.verify' directives contained within the artifact's '.doco-cd.yml' when determining policy. Second, it implements a no-downgrade behavior, ensuring that if 'OCI_TRUST_POLICY.enabled' is 'true' globally, no individual deployment configuration can downgrade or disable the verification status. This ensures that the global policy remains the immutable source of truth for security enforcement, regardless of the contents supplied within the OCI artifact."
}