7.8
Élevée
CVE-2026-113951 If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential…
Description
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Container 1.5 | premières → < 1.5.0 | 1.5.0 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Container
Les 5 CVE de Container →
CVE-2026-113957
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image…
5.6
Moyenne
CVE-2026-64773
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer…
7.5
Élevée
CVE-2026-64777
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of…
4.3
Moyenne
CVE-2026-20613
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname…
7.8
Élevée