Skip to main content

OCI Container Runtime CVE-2026-81494

MEDIUM
2026-08-31 vendor:ubuntu
Share

Severity by source

vuln.today AI
9.6 CRITICAL

Network vector because image is fetched from remote registry; UI:R because an operator must pull and run the image; scope change because container boundary is broken to affect the host.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Lifecycle Timeline

1
Analysis Generated
Aug 31, 2026 - 20:43 vuln.today

DescriptionCVE.org

[GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection]

AnalysisAI

Arbitrary host filesystem write is achievable via two distinct attack paths in an OCI image-handling component: symlinks planted inside OCI image layers that resolve outside the container root during image extraction, and newline characters injected into oci.dns.* annotation values that corrupt host-side configuration files written from those annotations. Both paths allow an attacker who controls an OCI image to write attacker-controlled data to arbitrary paths on the host system, breaking container isolation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation Exploitation requires that a target system pull and instantiate an attacker-controlled OCI image using the affected runtime. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS metrics are absent from the source record, so severity must be inferred entirely from the vulnerability description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult the GHSA advisory at https://github.com/advisories/GHSA-7fj9-65v4-rp7h for the canonical fix version - no exact patched release version is available from the current source record. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-81494 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy