{"schema":"vulnpedia.research/1","cve":"CVE-2026-104994","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g"},{"source":"nvd","sourceId":"CVE-2026-104994","modified":"2026-10-05T18:17:33.730","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g"},{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g"}]},{"url":"https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","url":"https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993"},{"source":"nvd","sourceId":"CVE-2026-104994","modified":"2026-10-05T18:17:33.730","url":"https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993"},{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993"}]},{"url":"https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","url":"https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md"},{"source":"nvd","sourceId":"CVE-2026-104994","modified":"2026-10-05T18:17:33.730","url":"https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md"},{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md"}]},{"url":"https://github.com/aquasecurity/trivy/pull/10664","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-02T19:52:36.831Z","url":"https://github.com/aquasecurity/trivy/pull/10664"},{"source":"nvd","sourceId":"CVE-2026-104994","modified":"2026-10-05T18:17:33.730","url":"https://github.com/aquasecurity/trivy/pull/10664"},{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://github.com/aquasecurity/trivy/pull/10664"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-104994","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-104994"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545329","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545329"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104994","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-104994"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104994","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104994"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72492","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72492"}]},{"source":"euvd","sourceId":"EUVD-2026-91789","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91789","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-91789","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91789"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json","productId":"Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64","product":"trivy-0:0.74.0-0.4.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:72492"},{"category":"workaround","details":"Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them."}],"purl":"pkg:rpm/redhat/trivy@0.74.0-0.4.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json"}]},{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json","productId":"Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src","product":"trivy-0:0.74.0-0.4.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:72492"},{"category":"workaround","details":"Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them."}],"purl":"pkg:rpm/redhat/trivy@0.74.0-0.4.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json"}]},{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json","productId":"Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64","product":"trivy-0:0.74.0-0.4.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:72492"},{"category":"workaround","details":"Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner's execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them."}],"purl":"pkg:rpm/redhat/trivy@0.74.0-0.4.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-104994","modified":"2026-10-09T04:23:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104994.json"}]}],"vendorCoverage":{"total":3,"shown":3,"omitted":0,"source":"redhat"}}