CVE-2026-44517 is a path traversal vulnerability in the Buildah tool used for building OCI images. Versions from 1.38.1 up to but not including 1.43.2, and a range starting at 1.44.0 but excluding 1.44.0, are affected. The vulnerability allows a malicious Git repository or tar archive server to cause files outside the intended build context directory to be included or copied into the build process. This issue is fixed in versions 1.43.2 and 1.44.0. The CVSS 3.1 score is 6.3, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
CVE-2026-47699 is a path traversal vulnerability in Confidential Containers Guest Components versions 0.16.0 through 0.19.x. It allows a crafted OCI image layer to create a hardlink outside the intended directory during image unpacking, potentially enabling a workload owner to escape into the pod virtual machine and abuse its capabilities. The issue is fixed in version 0.20.0.
CVE-2026-47766 is a vulnerability in crun, an open source OCI Container Runtime written in C. Prior to version 1.28, crun's default device setup opens the container root filesystem's /dev directory without the O_NOFOLLOW flag. This allows crun to follow symbolic links in the rootfs/dev directory, potentially creating device nodes and symlinks outside the container rootfs. This behavior can overwrite existing files such as ptmx. The issue is fixed in crun version 1.28.
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.
bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitrarily use the privileged operations, and in particular the "overlay mount" operation, allowing the creation of overlay mounts which is otherwise not allowed in the setuid version of bubblewrap. This issue has been patched in version 0.11.2.
Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection. Because PowerShell evaluates subexpressions inside double-quoted strings before executing the outer command, an attacker who can control the VM image path through a crafted machine name or image directory can execute arbitrary PowerShell commands with the privileges of the Podman process. On typical Windows installations this means SYSTEM-level code execution, and only Windows is affected as the code is exclusive to the HyperV backend. This issue has been patched in version 5.8.2.
CVE-2026-35406 is a medium severity vulnerability in aardvark-dns versions 1.16.0 through 1.17.0. It involves uncontrolled resource consumption where a truncated TCP DNS query followed by a connection reset causes the server to enter an unrecoverable infinite error loop at 100% CPU usage. This results in a denial of service condition. The issue is fixed in version 1.17.1.
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
CVE-2025-31133 is a vulnerability in the runc container runtime tool where insufficient verification of the source of bind-mounts for /dev/null allows attackers to exploit symbolic link following. This flaw enables arbitrary mount gadget attacks that can lead to host information disclosure, denial of service, container escape, or bypassing of maskedPaths protections. The issue affects specific versions of runc prior to 1.2.8, between 1.3.0-rc.1 and before 1.3.3, and certain 1.4.0 release candidates. It has a high severity rating and a CVSS 4.0 score of 7.3. Fixes are available in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVE-2025-61779 is a high-severity authorization bypass vulnerability in the Confidential Containers Trustee project versions prior to 0.15.0. The flaw exists because the attestation-policy endpoint does not verify if the requesting kbs-client is authenticated or authorized, allowing any client to modify attestation policies. This can lead to unauthorized changes in security policies governing confidential guest attestation and secret provisioning. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Version 0.15.0 of the Trustee project addresses this issue by enforcing proper authentication checks. European organizations using Confidential Containers Trustee in affected versions are at risk of unauthorized policy manipulation, potentially compromising confidentiality and integrity of sensitive workloads.