CVE-2026-107935

🗓️ 09 Oct 2026 09:05:43Reported by redhatType

cve🔗 web.nvd.nist.gov👁 27 Views🌐 WEB

Unauthenticated arbitrary file deletion on the host via gvisor-tap-vsock /expose endpoint.

Reporter	Title	Published	Views	Family All 19
AlpineLinux	CVE-2026-107935	9 Oct 202609:05	–	alpinelinux
Circl	CVE-2026-107935	9 Oct 202612:07	–	circl
CNNVD	The gvisor-tap-vsock container has a path traversal vulnerability	8 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose	9 Oct 202609:05	–	cvelist
Debian CVE	CVE-2026-107935	9 Oct 202609:05	–	debiancve
EUVD	EUVD-2026-95578	9 Oct 202609:05	–	euvd
Mend	CVE-2026-107935	9 Oct 202609:05	–	mend
NVD	CVE-2026-107935	9 Oct 202610:16	–	nvd
osv_bell	BELL-CVE-2026-107935	10 Oct 202606:05	–	osv_bell
osv_debian	DEBIAN-CVE-2026-107935	9 Oct 202610:16	–	osv_debian

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "0.4.0",
        "lessThan": "0.9.0",
        "versionType": "semver"
      }
    ],
    "packageName": "gvisor-tap-vsock",
    "collectionURL": "https://github.com/containers/gvisor-tap-vsock",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Build of Podman Desktop",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rh-podman-desktop",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:podman_desktop:1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhcertification/redhat-certification-system-ai-10",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:certifications:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Edge Manager 1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhem/flightctl-imagebuilder-worker-rhel10",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:edge_manager:1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "gvisor-tap-vsock",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "podman",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhel10/bootc-image-builder",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhel10-eus/rhel-10.0-bootc",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhel10-eus/rhel-10.2-bootc",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhel10/rhel-bootc",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ubi10/podman",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "container-tools:rhel8/podman",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "gvisor-tap-vsock",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "podman",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Hardened Images",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "podman",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:hummingbird:1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openshift4/microshift-bootc-rhel10",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openshift:4"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "podman",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openshift:4"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Dev Spaces",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "devspaces/udi-base-rhel10",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_devspaces:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 18.0",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhoso-operators/prometheus-podman-exporter-rhel9",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openstack:18.0"
    ]
  }
]

Source	Link
redhat	www.redhat.atlassian.net/browse/RHDESK-550
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/CVE-2026-107935
github	www.github.com/containers/gvisor-tap-vsock/pull/718

Parameter	Position	Path	Description	CWE
socket path	path	/services/forwarder/expose	The /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system via path traversal.	CWE-22

12 Oct 2026 10:16Current

6Medium risk

Vulners AI Score6

CVSS 3.19.3

EPSS0.00239

SSVC

CWE-22