CVE-2022-23648-POC

CVE-2022-23648을 위한 PoC 이것은 @fel1x의 CVE-2022-23648에 대한 개념 증명Proof of Concept입니다. 공개 정보는 여기, CVE 정보는 여기, 그리고 추가 정보와 완화 아이디어가 담긴 블로그는 여기에서 확인할 수 있습니다. Containerfile에 필요한 정보가 있으며, VOLUME의 대상을 변경하여 다양한 경로를 시험해 볼 수 있습니다. 작동하는 것을 보여주는 가장 쉬운 방법은 KinD를 사용하는 것입니다. KinD는 취약한 이미지를 가지고 있습니다. 기본 테스트 절차 노드에...

subpath-exploit

샘플 Kubernetes 탈출 - CVE-2017-1002101 이용 설명 이 문제에 대해 듣고 이 가이드를 따라가면서, 좀 더 탐구해보고 싶었습니다. 이 리포지토리는 몇 가지 파드 배포와 헬퍼 셸 스크립트를 포함하여, 쿠버네티스 관리자와 운영자가 심각성과 잠재적 위험을 완전히 이해할 수 있도록 공격 메커니즘을 가장 간단한 방식으로 보여줍니다. 인증된 사용자이거나 파드의 스펙/템플릿을 생성 시 제어할 수 있어야 하므로, 이 탈출은 다른 공격예: 이것과 결합하지 않으면 익명으로 이루어지지 않을 가능성이 높습니다. 빠른 설명...

vulnerable-container-hub

OWASP 취약 컨테이너 허브 프로젝트 배경 보안을 배우고자 하는 사람들에게 웹 애플리케이션, 컨테이너 또는 가상 머신과 같은 취약 환경을 제공하는 저장소는 많이 있습니다. 이러한 환경은 해당 분야에 갓 입문한 학생이나 신입이 관련 보안 기술을 배우는 데 도움이 될 뿐만 아니라, 보안 전문가가 실무 감각을 유지하는 데에도 도움이 되기 때문입니다. 이러한 접근 방식 중 요즘 가장 쉬운 방법은 컨테이너예: docker 또는 podman를 사용하는 것입니다. docker run 또는 docker compose up과 같은 단 하나의...

CVE-2026-41900-POC

OpenLearnX-RCE OpenLearnX コンテナボリュームマウントによる認証不要のRCE 差分ベースの検出 → サイレントパッチ → サンドボックスエスケープ → /tmp の完全開示 プロパティ| 値 ---|--- 名前| OpenLearnX-RCE CVE| CVE-2026-41900 GHSA| GHSA-8h25-q488-4hxw タイプ| 認証不要の情報開示 / RCE 影響を受けるバージョン| OpenLearnX コミット 14765d7 修正バージョン| コミット 14765d7 realcompilerservice CVSS| 8.6 高 CWE|...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424

Edgeless Systems Contrast versions up to and including 1.9.0 are vulnerable to an insecure volume mount issue. In bare-metal deployments, the containerd runtime adds a mount point for VOLUME directives defined in a Dockerfile when Kubernetes sets none. This allows an untrusted host to write arbit...

EUVD-2026-58187

podman quadlet install --replace does not fully replace the old file...

CVE-2026-84510

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination...

CVE-2026-84510

A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination...

CVE-2025-70819

Zettlab D6 Ultra before 1.7.0 is vulnerable to a directory traversal flaw in its compose-file volume handling. An attacker with low-privilege local access can craft a volume entry using repeated .. segments (e.g., ../../../../../../../etc:/h_etc:rw) to mount the host's /etc/passwd and /etc/shadow...

SUSE CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

EUVD-2025-210712

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext...

PT-2026-71070

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software fails to properly handle decryption errors, which allows encrypted volumes to be mounted as plaintext. Recommendations Update to version 7.7.4 or later...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

EUVD-2026-53473

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

PT-2026-68226

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can read, modify, or expose sensitive host files through Docker-based MCP servers. This occurs because of incomplete filtering of dangerous Docker volume-moun...

CVE-2026-17626: Incorrect Privilege Assignment

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...