Gaudi Container Runtime CVE-2026-32677

Exploitation requires: (1) local authenticated access to the target system with at least low OS privileges (PR:L, AV:L) - remote unauthenticated exploitation is not applicable; (2) specific attack preconditions to be present (AT:P per the CVSS 4.0 vector), the exact nature of which - such as a particular runtime configuration state, device mount condition, or container invocation mode - is not fully detailed in the available description and should be confirmed via Intel-SA-01489; (3) passive user interaction (UI:P), meaning a legitimate user must perform some routine action (e.g., launching a container workload) that the attacker can leverage or time their exploit against. Exploitation is limited to the vulnerable system itself - subsequent-system impact is explicitly none (SC:N/SI:N/SA:N). The combination of AT:P and UI:P substantially narrows the realistic exploitation window compared to the raw CIA impact scores suggest.

The overall real-world risk is moderate-to-low despite high per-system CIA impacts. CVSS 4.0 scores 5.4 (Medium), reflecting four meaningful constraints: local access required (AV:L), specific attack preconditions (AT:P), low but present privilege requirement (PR:L), and passive user interaction (UI:P). EPSS data is not available in the provided intelligence; no CISA KEV listing exists, and no public proof-of-concept is identified, making opportunistic mass exploitation unlikely. The SSVC signals suggest a 'Track' posture for most organizations: exploitation is not confirmed active, the product has a niche deployment footprint restricted to Intel Gaudi AI accelerator environments, and exploitation requires an authenticated local session plus specific runtime conditions. The subsequent-system impact is explicitly None (SC:N/SI:N/SA:N), meaning host breakout or lateral movement to other systems is not confirmed by the available data. Priority should be elevated only for organizations running multi-tenant Gaudi-accelerated compute environments where untrusted users share the same host. The AT:P modifier warrants vendor clarification on the exact precondition - this detail is inferred from the CVSS vector and description phrasing rather than confirmed by a detailed technical advisory.

An authenticated local user on a multi-tenant Gaudi-accelerated host submits a container workload crafted to pass a malicious path argument to the gaudi-container-runtime, exploiting the CWE-22 path traversal to resolve a filesystem path outside the container's intended scope. With the runtime executing at a higher privilege level, this traversal grants the attacker read or write access to sensitive host files - such as SSH keys, credentials, or privileged configuration - or enables overwriting of files to escalate to a more privileged OS identity. Passive interaction from another user (UI:P) and specific runtime preconditions (AT:P) must coincide for exploitation to succeed. No public proof-of-concept has been identified at time of analysis.