CVE-2026-108584 Details

A vulnerability allowing the exposure of hard-coded credentials has been identified in the FunnyWolf Viper Docker image, specifically in versions through 3.1.11. The issue arises from the inclusion of a .git directory in the Docker image, which contains a config file with plaintext credentials for a privileged Alibaba Cloud Codeup account. This vulnerability can be exploited remotely by pulling the public Docker image from Docker Hub and extracting the credentials, which grant admin access to private repositories.

Users should rotate or revoke the leaked Codeup account credentials and audit access logs for all repositories accessible by the account. The image should be rebuilt without the .git directory, and the new image published with a fresh digest. Users should not trust the previously published image and should inspect any environment that ran it for leaked credentials.