Hi team, we got few new high scored CVE (we build docker image with Pulumi CLI to run dotnet project with AutomationAPI), could you take a look? (all in Resource Path: home/.pulumi/bin/pulumi) name severity publish_date resource version fix_version ---- -------- ------------ -------- ------- ----------- CVE-2026-33186 critical 2026-03-20 google.golang.org/grpc v1.79.1 1.79.3 CVE-2026-33997 high 2026-03-31 github.com/moby/moby v28.3.3+incompatible 29.3.1 CVE-2026-34040 high 2026-03-31 github.com/moby/moby v28.3.3+incompatible 29.3.1 CVE-2026-34986 high 2026-04-06 github.com/go-jose/go-jose/v3 v3.0.4 3.0.5 Thanks, Slawek

Hi @late-judge-34866 What version of pulumi is this? Can you run

pulumi version

insider your docker container

Hey, this is the latest I think. Piece of our code we use to install pulumi:

ARG PULUMI_VERSION=3.229.0

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && curl -sL <https://aka.ms/InstallAzureCLIDeb> | bash \
    && curl --proto '=https' -L <https://get.pulumi.com> | sh -s -- --version "${PULUMI_VERSION}" \
    && /home/.pulumi/bin/pulumi version \

@late-judge-34866 Let me see what i can find out

we run 3.229 (will double check), but interestingly, in go-jose PR you mentioned above I see also google.golang.org/grpcindirectminor`v1.63.2` ->

v1.79.3

?

Re Moby: I’m not on the core team, so this is just my read of the public repo. From what I can see, Renovate does notice that

moby

is out of date, but it is only surfacing an update to

28.5.2

, not the

29.3.1

version your security tool says is needed. So I would not assume these get picked up automatically by Pulumi’s normal dependency automation. You may need either a security exception / reachability review on your side. To me, these do not obviously look exploitable just because they appear inside the Pulumi CLI binary in a Docker image.

@modern-spring-15520 thanks for looking into this one. I can confirm, that with latest release v3.230.0 CVE-2026-33186 & CVE-2026-34986 are gone.