From 4f59eaceeab3bf6f24c7d8782c3394370d4b7240 Mon Sep 17 00:00:00 2001
From: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Date: Tue, 24 Mar 2026 12:10:49 -0300
Subject: [PATCH] Add ignores for CVE-2026-0861 in bomutils (#42292)

Resolves
https://github.com/fleetdm/fleet/actions/runs/23476296008/job/68309683127.

Run:
- https://github.com/fleetdm/fleet/actions/runs/23487678187
- https://github.com/fleetdm/fleet/actions/runs/23487670926
---
 security/status.md                           |  8 +++++-
 security/vex/bomutils/CVE-2026-0861.vex.json | 29 ++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 security/vex/bomutils/CVE-2026-0861.vex.json

diff --git a/security/status.md b/security/status.md
index 205d809aaf..6eed9020c0 100644
--- a/security/status.md
+++ b/security/status.md
@@ -423,5 +423,11 @@ Following is the vulnerability report of Fleet and its dependencies.
 
 ## `fleetdm/bomutils` docker image
 
-No vulnerabilities tracked at the moment.
+### [CVE-2026-0861](https://nvd.nist.gov/vuln/detail/CVE-2026-0861)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** Use of mkbom and xar from fleetdm/bomutils have admin controlled inputs.
+- **Products:**: `bomutils`,`pkg:deb/debian/libc6`,`pkg:deb/debian/libc-bin`
+- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
+- **Timestamp:** 2026-03-24 08:41:27
 
diff --git a/security/vex/bomutils/CVE-2026-0861.vex.json b/security/vex/bomutils/CVE-2026-0861.vex.json
new file mode 100644
index 0000000000..6a22675df6
--- /dev/null
+++ b/security/vex/bomutils/CVE-2026-0861.vex.json
@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-260ad6f7da65c07c942566f638dc0d1fe9a13e7e713b2e6085f0d66ed8691345",
+  "author": "@lucasmrod",
+  "timestamp": "2026-03-24T08:41:27.675383-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-0861"
+      },
+      "timestamp": "2026-03-24T08:41:27.675384-03:00",
+      "products": [
+        {
+          "@id": "bomutils"
+        },
+        {
+          "@id": "pkg:deb/debian/libc6"
+        },
+        {
+          "@id": "pkg:deb/debian/libc-bin"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "Use of mkbom and xar from fleetdm/bomutils have admin controlled inputs",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary"
+    }
+  ]
+}