Path traversal in gvisor-tap-vsock lets attackers delete host files
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
gvisor-tap-vsock from 0.4.0 before 0.9.0 is affected. A path traversal flaw (CWE-22) in gvproxy, the network forwarder that the package provides, lets an unauthenticated attacker on an adjacent network delete arbitrary files on the host system through the /services/forwarder/expose endpoint, which does not validate the caller-supplied socket path.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | gvisor-tap-vsock | 0.4.0 to before 0.9.0 | 0.9.0 | Patch available | CNA |
| Red Hat | Red Hat Build of Podman Desktop | — | — | No fix listed | CNA |
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Edge Manager 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Hardened Images | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Dev Spaces | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | No fix listed | CNA |
- gvisor-tap-vsock Vendor— Affected 0.4.0 to before 0.9.0 Fixed in 0.9.0 Patch available CNA
- Red Hat Build of Podman Desktop VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Certification Program for Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Edge Manager 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Dev Spaces VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:podman_desktop:1 | 1 | — | Red Hat |
| cpe:/a:redhat:certifications:9 | 9 | — | Red Hat |
| cpe:/a:redhat:edge_manager:1 | 1 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:10 | 10 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8 | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9 | 9 | — | Red Hat |
| cpe:/a:redhat:hummingbird:1 | 1 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift:5 | 5 | — | Red Hat |
| cpe:/a:redhat:openshift_devspaces:3 | 3 | — | Red Hat |
- cpe:/a:redhat:podman_desktop:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:certifications:9 Versions 9 — ·Red Hat
- cpe:/a:redhat:edge_manager:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat
- cpe:/a:redhat:hummingbird:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat
- cpe:/a:redhat:openshift_devspaces:3 Versions 3 — ·Red Hat
Remediation
Upgrade gvisor-tap-vsock to version 0.9.0. Red Hat lists these products as affected without a fix: Red Hat Build of Podman Desktop, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Edge Manager 1, Red Hat Enterprise Linux 8, 9 and 10, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4 and 5, Red Hat OpenShift Dev Spaces and Red Hat OpenStack Platform 18.0. Red Hat gives no fix plan for Red Hat Build of Podman Desktop and Red Hat OpenShift Dev Spaces.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA gvisor-tap-vsock Fixed in 0.9.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Edge Manager 1 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Hardened Images | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | — |
| Red Hat OpenShift Container Platform 5 | Affected | — |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | — |
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107935
- 2026-10-09 Alias added: GHSA-hp8g-9vjx-j62m
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-10 Priority changed: MEDIUM → LOW
- 2026-10-11 Priority changed: LOW → MEDIUM
- 2026-10-12 Fix available: [email protected] · CNA
- 2026-11-04 Affected versions changed · CNA
- 2026-11-05 Affected versions changed · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-107935 · CVE Program
- CVE-2026-107935 · NVD
- FIRST EPSS
- GHSA-hp8g-9vjx-j62m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107935 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences