54 matches found
CVE-2025-9074
CVE-2025-9074 - Docker 远程 API（实验室 PoC） ⚠️ 免责声明： 本仓库仅供教育和研究目的 使用。 请不要 在您拥有控制权之外的环境中使用此代码。 作者对滥用行为不承担任何责任。 概述 本仓库包含针对 CVE-2025-9074 的概念验证（PoC），这是一个涉及 Docker 远程 API 的配置错误漏洞。 当 Docker 守护进程未经验证暴露时，攻击者可以发出 API 请求来创建和启动容器。 此 PoC 在安全可控的环境中演示了该问题。 注意： 此漏洞已修复。 原始文章 原始研究和文章归功于： 🔗 qwertysecurity.com – 博客文章...
poc-2025-9074
CVE-2025-9074 | Docker API CVE-2025-9074 PoC（概念验证） 针对 CVE-2025-9074 的高级利用框架，目标为未经认证的 Docker API 端点，并集成交互式命令 Shell。 概述 本工具自动利用暴露的、未启用认证机制的 Docker API 实例，允许在目标主机上创建完整容器并执行命令。该工具具备自定义交互式 Shell，可实现无缝的后渗透操作。 注意： 这是自定义的概念验证实现。我并未发现 CVE-2025-9074。 演示 初始利用 自动化漏洞检测、镜像拉取、容器创建与初始化 交互式命令执行 具备命令执行能力的后渗透 Shell...
CVE-2024-21626-POC
CVE-2024-21626-POC 使用说明 仅供教育/研究使用，任何与教育/研究无关的行为所产生的风险自行负责 使用 root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy 注意 不同docker/runc版本使用的具体文件描述符有所不同，例如docker server:20.10.17 && runc version 1.1.2 的情况下使用 /proc/self/fd/9，实际的 fd...
AZL-97649 CVE-2026-17113 affecting package cri-o 1.30.1-1
A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...
PT-2026-81044
Name of the Vulnerable Software and Affected Versions CRI-O affected versions not specified Description A flaw exists in the container-creation environment-variable handling within the mergeEnvs function located in server/utils.go and used by setupContainerEnvironmentAndWorkdir in server/containe...
[SECURITY] Fedora 43 Update: buildah-1.43.2-1.fc43
The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...
CVE-2026-47262
CVE-2026-47262 affects containerd where a maliciously crafted image can trigger a Denial of Service by exhausting memory during container creation, causing an Out-Of-Memory (OOM) kill of the containerd process and making the runtime API unavailable (impacting clients like Docker Engine and Kubern...
[SECURITY] Fedora 44 Update: buildah-1.43.2-1.fc44
The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...
CVE-2026-44850 Portainer: Bind-mount restriction bypass via HostConfig.Mounts
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer offers an environment-level Disable bind mounts for...
CVE-2026-44850 Portainer: Bind-mount restriction bypass via HostConfig.Mounts
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer offers an environment-level Disable bind mounts for...
OESA-2026-2434 buildah security update
The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...
Portainer has a bind-mount restriction bypass via HostConfig.Mounts
Summary Portainer offers an environment-level Disable bind mounts for non-administrators security setting that blocks regular users from binding host paths into containers they create through the Portainer-mediated Docker API. The check that enforces this setting only inspected the legacy...
GHSA-7FW3-X4R2-G7WC Portainer has a bind-mount restriction bypass via HostConfig.Mounts
Summary Portainer offers an environment-level Disable bind mounts for non-administrators security setting that blocks regular users from binding host paths into containers they create through the Portainer-mediated Docker API. The check that enforces this setting only inspected the legacy...
[SECURITY] Fedora 44 Update: buildah-1.43.1-1.fc44
The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...
Cross-Site Request Forgery (CSRF)
github.com/canonical/lxd is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper validation of client-side authentication tokens, which allows an attacker to trigger container creation and startup through crafted HTML form submissions without user consent...
[SECURITY] Fedora 43 Update: buildah-1.42.0-4.fc43
The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...
Cross-site Request Forgery (CSRF)
Overview org.jenkins-ci.plugins:windocks-start-container is an Allows users to create running containers based on Images available on the WinDocks host. WinDocks is a port of Docker’s open source to Windows, and supports all editions of Windows 8, Windows 10, Windows Server 2012, and Windows Serv...
Linux Distros Unpatched Vulnerability : CVE-2025-54286
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-Site Request Forgery CSRF in LXD-UI in Canonical LXD versions = 5.0 on Linux allows an attacker to create and start container instances without user conse...
CVE-2025-54286
Cross-Site Request Forgery CSRF in LXD-UI in Canonical LXD versions = 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication...
