CVE-2024-21626-demo

CVE-2024-21626-demo Demo for the LT at Container Runtime Meetup 5. This is to raise awareness of the attack risk based on publicly known information, and misuse is strictly prohibited. Slides Container Runtime Meetup 5 - Can You Really Trust That Image? Taking Host Root with CVE-2024-21626 Loggin...

Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: runc Container Breakout Deconstruction Advanced Purple Teaming & Forensic Analysis of Host Root Escape 🛡️ Overview This repository contains a high-fidelity deconstruction and Proof-of-Concept PoC for...

CVE-2026-84042

crun is a lightweight OCI container runtime. This flaw affects builds that include libkrun with passt networking enabled (krun.use_passt). When a container is started rootful , crun can execute an attacker-controlled payload embedded in the container image with host root privileges , effectively ...

EUVD-2026-75321

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

CVE-2026-84042 Crun: crun: rootful krun with passt executes container payload as host root

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 Kernel Live Patch KVM/x86 English |简体中文 A kernel live patch that fixes CVE-2026-64561 Zapscape on CentOS Stream 8 / RHEL 8 KVM hosts all 4.18.0- kernels. Without the patch : a tenant VM guest can escape to the host with guest-side actions alone and execute code with...

Linux Distros Unpatched Vulnerability : CVE-2026-66897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, ...

DEBIAN-CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897

A path traversal vulnerability in LXD 's instance template processing allows an attacker with container edit permissions—or any user launching a crafted image—to overwrite arbitrary host files as root , achieving host-level code execution. The root cause is a discrepancy between path validation (...

CVE-2026-47243

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243

Kata Containers runtime-rs is affected by a guest-root to host-root escape in the virtio-fs path prior to version 3.31.0. In configurations using the host virtiofsd with --sandbox none and --seccomp none, a root-equivalent attacker inside the guest can bypass the guest virtio-fs client by taking ...

CVE-2026-44210

A flaw was found in Kata Containers, an open-source project that provides lightweight virtual machines VMs for containers. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, which manages shared file systems. This injection allows an...

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface CRI plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands o...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

EUVD-2026-39794

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...