Read the docs
TI-2022-18585 Aliases CVE-2022-39206

CI/CD Docker Escape in OneDev

Priority HIGH 76CWE-610Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02194 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed onedev (theonedev): 7.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
theonedevonedevbefore 7.3.07.3.0Patch availableCNA
  • onedev Vendortheonedev Affected before 7.3.0 Fixed in 7.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*before 7.3.0Vulnerabletheonedev
  • cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:* Versions before 7.3.0 Vulnerable ·theonedev

Remediation

  • Fix · CNA onedev (theonedev) Fixed in 7.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39206

References

Exploit 1

Patch 1

Advisory 1

  • TI-2021-04345 Pre-Auth Unsafe Deserialization on AttachmentUploadServet CVSS 3.1CRITICAL 10.0
  • TI-2022-18584 Access Control Bypass in Onedev CVSS 3.1CRITICAL 9.8
  • TI-2021-04346 Pre-Auth Unsafe Deserialization on KubernetesResource CVSS 3.1CRITICAL 10.0
  • TI-2022-18587 Git Repository Disclosure in Onedev CVSS 3.1HIGH 7.5
  • TI-2021-04349 Pre-Auth Access token leak CVSS 3.1HIGH 8.6
  • TI-2024-30380 OneDev vulnerable to arbitrary file reading for unauthenticated user CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences