Security Flaw in Docker Compose Linter by tmatens

CVE-2026-123369

What is CVE-2026-123369?

compose-lint is a Docker Compose security linter that helps identify potential misconfigurations before deployment. Prior to version 0.31.0, it had a significant issue where it would output attacker-controlled service names, environment keys, and other components without adequately neutralizing them, particularly in the context of GitHub Actions and Azure Pipelines. This could allow malicious users to manipulate CI/CD output by creating misleading annotations and masking vital information. While the output did not alter the exit code for compose-lint, it presented an inaccurate representation in the CI logs, which could deceive reviewers. The issue has been addressed in version 0.31.0.

References