cve-2025-9074-poc

CVE-2025-9074 教育用 PoC・概念验证代码 本仓库包含一个用于教育目的的 PoC，演示了利用 Docker Engine 的未认证远程 API 创建可读写主机文件系统的特权容器的风险。 执行文件为 poc.go。 重要：本 PoC 仅限用于教育及防御目的。禁止在第三方环境或未经授权的系统上执行。 危险性评估 综合评估：严重 预估 CVSS v3.1 基本分：9.8 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 依据： 未认证即可访问 TCP/2375 → PR:N, UI:N, AV:N 通过特权容器 +...

cve-2024-21626

CVE-2024-21626 概述 此仓库包含一个易受 CVE-2024-21626 攻击的应用程序代码示例，以及一个用于检测利用尝试的 eBPF gadget。 该仓库是作为此博客文章的一部分创建的。 用于检测此漏洞的 gadget 程序仅供演示之用。它并非对 CVE-2024-21626 的完整检测。 漏洞描述 CVE-2024-21626 是 runc 容器运行时中的一个漏洞，存在于 v1.1.12 之前的版本。它利用 runc 在容器内创建或执行命令时未能及时关闭"泄漏"的文件描述符，导致容器继承了该文件描述符，从而获得对主机文件系统的访问权限。...

CVE-2024-21626

CVE-2024-21626 漏洞利用（工作目录） docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm 关键是设置 -w /proc/self/fd/8\ 在容器内使用 cat ../../../../../../../../../etc/passwd 访问主机文件系统 漏洞利用（符号链接） 1. docker run --name cve-2024-21626 --rm --it debian:bootworm 2. 在容器内 - ln -sf /proc/self/fd/7/ /fo...

GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293

The CVE-2026-63293 entry concerns LXD: during image import/unpack, metadata.yaml is not validated as a symlink, enabling a crafted image archive to point to host filesystem paths. This can allow arbitrary file read and write on the host, escalating to full access via symlink traversal. The descri...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982

The CVE concerns RHOAI training-operator. Affected component: training-operator within Kubernetes environments. Privilege escalation arises from aggregating training job permissions onto native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough. A user ...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

PT-2026-69968

Name of the Vulnerable Software and Affected Versions RHOAI training-operator affected versions not specified Description A flaw allows users with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service...

SUSE CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-15584

A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

CVE-2026-50566 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability...

CVE-2026-33590

Insecure default settings of Portainer CE grant regular non-admin users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the...

CVE-2026-33590

Insecure default settings of Portainer CE grant regular non-admin users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the...