CVE-2026-113951: If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. in Apple Container

This vulnerability arises from the ability of an attacker to write to the filesystem of a container running a Kubernetes cluster. By placing a malicious exec credential plugin in /etc/kubernetes/admin.conf, the attacker can cause kubectl, when run on the macOS host after pulling the kubeconfig, to execute arbitrary commands with the host user's privileges. This effectively escalates filesystem access inside an untrusted Linux container to arbitrary code execution on the macOS host. The issue is resolved in Container version 1.5.0.

An attacker who can write to the container filesystem can achieve arbitrary command execution on the macOS host user context when kubectl is run with the compromised kubeconfig. This represents a significant privilege escalation from container filesystem access to host-level code execution.

Upgrade to Container version 1.5.0 or later, where this vulnerability is addressed. No other mitigation steps are indicated in the available information.