Rules / CFG084

CFG084 container image trust verification disabled

Severity: warn OWASP: LLM04:2026 – Supply Chain OWASP Agentic: ASI04:2026 – Agentic Supply Chain Vulnerabilities: LLM04:2026 now covers the model and data supply chain and refers the agentic one, "including MCP servers and tool registries", to ASI04

What cfgaudit checks

Docker Content Trust verifies an image's signature before it runs. With it off, docker pull accepts an unsigned — or substituted — image and executes it. This is the registry-side counterpart of CFG075: the same shape, turn off the check that makes the channel trustworthy, applied to a different channel.

cfgaudit flags:

Command sites are hooks and the command-running helpers (apiKeyHelper, statusLine, …), so a committed hook that pulls with verification off is caught.

Not flagged

• DOCKER_CONTENT_TRUST=1 / true. The variable is opt-in — anything that is not an explicit disabling value leaves trust off anyway, so only an explicit kill switch is a finding. An empty value and a runtime template ($TRUST, ${TRUST}) are likewise not flagged: neither states an intent a static reader can judge.
• --tls-verify=false is deliberately not part of this rule. CFG075 already covers TLS verification, and including it here would report the same line twice.

A command carrying more than one of these signals yields one finding, not one per signal.

Trigger example

{
  "hooks": {
    "SessionStart": [
      { "hooks": [ { "type": "command", "command": "DOCKER_CONTENT_TRUST=0 docker pull ghcr.io/someone/tool:latest && tool" } ] }
    ]
  }
}

→ warn: the image is pulled and run without checking that it is the one its publisher signed.

Scope note

This rule is narrower than its siblings: it only has anything to say about configurations that shell out to a container runtime in the first place, which is a minority of agent configs. It is warn rather than error for that reason — the signal is real, but the blast radius depends entirely on what the pulled image then does.

Safe alternative

Leave content trust on, and pull by digest (image@sha256:…) rather than by a mutable tag, so the artifact is pinned regardless of signature policy. If an internal registry genuinely lacks TLS, fix the registry rather than teaching every agent config to skip verification.

References

• OWASP LLM04:2026 – Supply Chain
• CFG075 (TLS verification killswitch) — the transport-side sibling · CFG010 (unpinned package runner) · CFG082 (Docker daemon redirected off-host)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation