EUVD-2026-75360
GHSA-cwhr-hwj2-cjrp
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Local low-privilege access required; AC:H because non-default /dev configuration is mandatory; scope changed to host with integrity-only impact via chown.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
AnalysisAI
Symlink-following in crun's container runtime allows a low-privileged container user to redirect stdio file descriptors to host files and alter their ownership. Affecting crun 1.29.1 and earlier, the flaw manifests when crun reopens /dev/null for stdio after pivot_root: if the container's /dev/null has been replaced with a symlink to a host path, crun resolves the symlink outside the container namespace and chowns the target file to the container UID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the container runtime does NOT mount a fresh tmpfs /dev at container start - the CVE description explicitly states 'Default configurations that mount a fresh /dev are not exposed.' The vulnerable condition is a non-default deployment where the host /dev or a pre-populated /dev is visible inside the container at the time of pivot_root execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N scores 5.6 (Medium), and the signal set supports treating this as a genuine but conditional risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is available at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
The Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privi
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today