SUSE · Security update for apptainer
Affects SUSESource GCVE Database
Not known to be exploited.
Data as of 10 Nov 2026, 20:06 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Exploitation evidence
Disclosed: evidence found.
CVE published 10 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
Description
This update for apptainer fixes the following issues: Changes in apptainer: - Update apptainer to version v1.5.1 * Security fix (bsc#1267982): Fix for CVE-2026-48785 / GHSA-cr2j-534f-mf3g. Incorrect path matching for limit container paths directive. This is only applicable to SUID installations that have paths listed in limit container paths that are string prefixes of other paths which are not desired to be included in the list. For example, if /scratch is in the list but `/scratch2` also exists and contains container images, previously the latter would match but now only images under the exactly matching `/scratch` are included. Other changes: * Work around segmentation fault sometimes seen while `mksquashfs` under proot is creating a SIF file. * Update bundled PRoot to version 5.4.0-rootless.3 in order to fix a problem where SIF files could be corrupted when `mksquashfs` died with a signal. The proot command was not passing back an error exit code. * Updated bundled `squashfuse_ll` to version 0.6.2 in order to fix a crash sometimes seen with apptainer in unprivileged docker. * Update bundled fuse2fs to version 1.47.4 instead of patching the bugs in 1.47.3. * Fix a crash that happened when `/etc/resolv.conf` was a symlink while building from a definition file using the localimage bootstrap. * Support hosts that have an /etc/resolv.conf symlink pointing to `../run` in addition to `/run`. * Change the download-dependencies script to skip downloading the PRoot source code on architectures that it is known to not support (that is: ppc*, s390*, and riscv*). In those situations Apptainer will skip trying to compile and run proot. As a result original owners and groups of files will not be preserved in SIF images built by unprivileged users, as was the case for all architectures prior to 1.5.0. * Fix panic encountered during progress bar update while pulling image. * Fix fakeroot overwriting root's username in `/etc/passwd` with the host user's name, a regression introduced in v1.5.0. * Add nonested flag for --mount specifications to prevent individual bind mounts from being passed to nested containers via `APPTAINER_BIND`. Example: `--mount type=bind,source=/data,destination=/mnt,nonested`. - Changes from version v1.5.0: New Features & Functionalities * Add support for a subset of the Container Device Interface (CDI) standard through new `--device` and `--cdi-dirs run/shell/exec` options. Honors environment variable settings, bind mounts, and device files listed in CDI specification files. * Add support for selective mounting of Intel(R) Gaudi accelerators. This feature is only for use in combination with a minimal /dev directory, selected either with the `--contain` flag or by configuring mount dev with the minimal option; otherwise all the devices are available anyway. This feature is enabled via the `--intel-hpu option` and by specifying the HABANA_VISIBLE_DEVICES environment variable, which should contain a comma-separated list of device IDs (e.g., "1,2,3") or "all" to import all of them. The default if `HABANA_VISIBLE_DEVICES` is not set is "all". * Add support for downloading SIF images from an IPFS peer-to-peer cluster using an HTTP gateway (similar to the existing support for IPFS in the curl tool). The address of the gateway can be set in the `IPFS_GATEWAY` environment variable or read from ~/.ipfs/gateway or /etc/ipfs/gateway. * Add `--no-env` action and instance option and corresponding `APPTAINER_NOENV` environment variable that can provide a comma-separated list of environment variables to skip importing from the host environment into the container. * Add `--data` build option which creates a SIF file with a squashfs data partition instead of a code partition, given an existing squashfs file as the source. * If `PREPEND_LD_LIBRARY_PATH` is set in the container environment (through an `--env` option, an `APPTAINERENV_` prefix from the host, or in the container definition) then prepend that string to `:$LD_LIBRARY_PATH`. Likewise if `APPEND_LD_LIBRARY_PATH` is set in the container environment then append that string to `$LD_LIBRARY_PATH:`. This is only done when `LD_LIBRARY_PATH` is set, although if the container is based on glibc, when `LD_LIBRARY_PATH` is not set it will first be filled with the default library search path as found through ldconfig. * Create reproducible SIF images, if the environment variable `SOURCE_DATE_EPOCH` has been set (as a Unix timestamp given as seconds since the beginning of 1970, in the UTC timezone). Also add `--reproducible` flag to build and pull from `oras://` sources. This sets `SOURCE_DATE_EPOCH` automatically from the i