{"uuid": "5764ea21-d5b4-4b8d-9a6d-47333927dd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41178", "type": "seen", "source": "https://gist.github.com/cwayne18/5a965b20d5d77b66faec2e6e18802a48", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/helm-controller:v0.17.7 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN --llm --llm-command \"gh copilot\" --mine-advisories --triage --details\nLLM overlay: asking command gh\nExtracting docker.io/rancher/helm-controller:v0.17.7 (linux/amd64)...\nScanning for Go binaries...\nFound 1 Go binaries.\nResolving advisories for 73 components (73 OSV queries)...\nFound 16 OS packages to check (Alpine:v3.24).\nResolving advisories for 10 components (14 OSV queries)...\nBuilding the shared-library closure...\n  18 ELF objects\n  8 of 18 reachable from 6 roots\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 2 finding(s) already covered by a published statement\nTriaging 5 findings against EPSS and CISA KEV (5 CVE ids)\nvexscan report (image) for docker.io/rancher/helm-controller:v0.17.7\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE            VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2025-3521  k8s.io/kubernetes  v1.35.1  no fix    41.1%\nUNKNOWN   GO-2026-5970  golang.org/x/text  v0.37.0  0.39.0    36.6%\nUNKNOWN   GO-2025-3547  k8s.io/kubernetes  v1.35.1  no fix    22.3%\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3521\n  from:     golang\n  epss:     41.1% percentile (epss 0.00516) for CVE-2025-1767\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller merely vendors k8s.io/kubernetes as a library dependency and static analysis shows only linkage, not call-graph reachability; such binaries typically use small subsets (client/apimachinery types) rather than the vulnerable server-side code paths, and GO-2025-3521 class kube vulnerabilities generally require running as an apiserver/kubelet component to be triggered by attacker input.\n\n[LINKED]               golang.org/x/text@v0.37.0\n  cve:      GO-2026-5970\n  from:     golang\n  fixed in: 0.39.0\n  epss:     36.6% percentile (epss 0.00446) for CVE-2026-56852\n  purl:     pkg:golang/golang.org%2Fx%2Ftext@v0.37.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/text/unicode/norm (package)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=medium\n            golang.org/x/text/unicode/norm is a transitive dependency typically pulled in for string normalization; helm-controller is a Kubernetes reconciliation controller unlikely to run Unicode normalization on attacker-controlled input paths, and static linkage alone doesn't establish reachability from network-facing code.\n\n[LINKED]               k8s.io/kubernetes@v1.35.1\n  cve:      GO-2025-3547\n  from:     golang\n  epss:     22.3% percentile (epss 0.00301) for CVE-2024-7598\n  purl:     pkg:golang/k8s.io%2Fkubernetes@v1.35.1\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: k8s.io/kubernetes (module)\n  detail:   linked\n  llm:      exploitable=unlikely confidence=low\n            k8s.io/kubernetes is a large module often pulled in only for API types/client libraries rather than actual server logic, and static analysis shows only linkage (not reachability) in a helm-controller binary, which typically doesn't run the vulnerable kube-apiserver/kubelet code paths; without confirmed call-path reachability or attacker-controlled input to the vulnerable function, real-world exploitability is low.\n\n\nALREADY VEXED (1) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY      PACKAGE           VERSION  FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nUNKNOWN   GO-2026-5942  golang.org/x/net  v0.55.0  0.56.0    26.4%  not_affected  vulnerable_code_not_present\n\n[LINKED]               golang.org/x/net@v0.55.0\n  cve:      GO-2026-5942\n  from:     golang\n  fixed in: 0.56.0\n  epss:     26.4% percentile (epss 0.00339) for CVE-2026-46600\n  purl:     pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: golang.org/x/net/dns/dnsmessage (package)\n  detail:   linked\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-22T03:28:02Z\n            matched loosely: statement names pkg:golang/golang.org/x/net@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.55.0\n  llm:      exploitable=unlikely confidence=medium\n            helm-controller links golang.org/x/net/dns/dnsmessage transitively (e.g. via net/http or Kubernetes client libraries) but does not itself\nperform custom DNS message parsing of attacker-controlled data; typical Go DNS resolution paths rarely trigger the vulnerable code path with untrusted\n input.\n\n\nRULED OUT (1) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION  FIXED IN  EPSS   BASIS\nUNKNOWN   GO-2026-5158  go.opentelemetry.io/otel  v1.41.0  1.44.0    14.7%  pclntab\n\n[NOT PRESENT]          go.opentelemetry.io/otel@v1.41.0\n  cve:      GO-2026-5158\n  from:     golang\n  fixed in: 1.44.0\n  epss:     14.7% percentile (epss 0.00237) for CVE-2026-41178\n  purl:     pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  binary:   /usr/bin/helm-controller (stripped)\n  packages: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package)\n  vex:      vulnerable_code_not_present [pclntab]\n  evidence: [vendor-vex] Rancher Security team published not_affected for pkg:golang/github.com/k3s-io/helm-controller (vulnerable_code_not_present);\nstatement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n  vendor:   Rancher Security team says not_affected (vulnerable_code_not_present)\n            Govulncheck determined that the vulnerable code isn't called\n            product pkg:golang/github.com/k3s-io/helm-controller, published 2026-07-25T03:31:58Z\n            matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0\n\n\n  golang   Go                         73 components     5 findings\n  os       Alpine:v3.24               16 components     0 findings\n  affected by severity: 3 unknown\n  3 affected: 1 fixable, 2 with no fix yet\n  already vexed: 1 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 3 scored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  5 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (1), RULED OUT (1)", "creation_timestamp": "2026-08-05T22:37:18.396564Z"}