Read the docs
TI-2026-30133 Aliases CVE-2026-41579GHSA-xjvp-4fhw-gc47

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Priority LOW 15CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Partial runc (opencontainers): 1.3.6, 1.4.3, 1.5.0-rc.3github.com/opencontainers/runc (Go): 1.3.6, 1.4.3, 1.5.0-rc.3Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageruncbefore 1.3.6; 1.4.0-rc.1 to before 1.4.3; 1.5.0-rc.1 to before 1.5.0-rc.31.3.6, 1.4.3, 1.5.0-rc.3Patch availableCNA
—github.com/opencontainers/runc (Go)before 1.3.61.3.6Patch availableGHSA-xjvp-4fhw-gc47
—github.com/opencontainers/runc (Go)1.4.0 to before 1.4.31.4.3Patch availableGHSA-xjvp-4fhw-gc47
—github.com/opencontainers/runc (Go)1.5.0-rc.1 to before 1.5.0-rc.31.5.0-rc.3Patch availableGHSA-xjvp-4fhw-gc47
  • runc Vendorbackstage Affected before 1.3.6; 1.4.0-rc.1 to before 1.4.3; 1.5.0-rc.1 to before 1.5.0-rc.3 Fixed in 1.3.6, 1.4.3, 1.5.0-rc.3 Patch available CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.3.6 Fixed in 1.3.6 Patch available GHSA-xjvp-4fhw-gc47
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.4.0 to before 1.4.3 Fixed in 1.4.3 Patch available GHSA-xjvp-4fhw-gc47
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.5.0-rc.1 to before 1.5.0-rc.3 Fixed in 1.5.0-rc.3 Patch available GHSA-xjvp-4fhw-gc47

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*before 1.3.6; 1.4.0 to before 1.4.3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.5.0:rc1:*:*:*:*:*:*1.5.0 rc1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.5.0:rc2:*:*:*:*:*:*1.5.0 rc2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.3.6; 1.4.0 to before 1.4.3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.5.0:rc1:*:*:*:*:*:* Versions 1.5.0 rc1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.5.0:rc2:*:*:*:*:*:* Versions 1.5.0 rc2 Vulnerable ·backstage

Remediation

  • Fix · CNA runc (opencontainers) Fixed in 1.3.6, 1.4.3, 1.5.0-rc.3
  • Fix · GHSA-xjvp-4fhw-gc47 github.com/opencontainers/runc (Go) Fixed in 1.3.6 Advisory →
  • Fix · GHSA-xjvp-4fhw-gc47 github.com/opencontainers/runc (Go) Fixed in 1.4.3 Advisory →
  • Fix · GHSA-xjvp-4fhw-gc47 github.com/opencontainers/runc (Go) Fixed in 1.5.0-rc.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41579
  2. 2026-10-03 Alias added: GHSA-xjvp-4fhw-gc47
  3. 2026-11-06 Affected versions changed · Red Hat

References

Patch 2

Other 1

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
  • TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences