UpHeron
All vulnerabilities

Servers and applications

CVE-2026-119101

malicious image can bind-mount an arbitrary host directory into a container across checkpoint/restore

Severity
High 7.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
1.3.7, 1.4.4, 1.5.3, 1.6.0-rc.2
Weakness
Injection (CWE-74)
Attack
Needs local access · Needs a user account · Needs someone to click or open something
Attacker can
Read data · Change data
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Also known as
GHSA-g2c3-j8g3-7gpw
Sources
Project advisories (GitHub)

Description

When a container is checkpointed and restored with CRIU, runc registers every bind mount (and every device) of the container configuration with CRIU as an external mount, using the mount destination resolved inside the container's own rootfs as the lookup key. CRIU encodes each external mount as the single string mnt[KEY]:VAL and looks entries up by prefix, so a key that contains ]: terminates early and shifts the boundary between the key and the value. A malicious image can therefore place ]: in a symlink target in its rootfs and make runc restore, running as host root, bind-mount a host path that the configuration never named into the restored container, read-write.

This is the same issue as CVE-2026-115520 (GHSA-2mxx-58qc-p466) in crun.

Affected since runc 1.1.0, which added the symlink resolution of mount destinations for checkpoint/restore (commit 74ae9e0f, "checkpoint: resolve symlink for external bind mount").

From opencontainers/runc's security advisory. Shortened; the full text is there.

Workarounds

  • Upgrade CRIU to 4.3.1 or later, which fixes the issue on the CRIU side (GHSA-7ww7-53q2-wrwx, CVE-2026-119614) and thus also protects older runc versions.
  • Do not restore checkpoints of containers running untrusted images.
Workarounds as given by opencontainers/runc's security advisory.

Affected software

SoftwareAffected versions
runcServers and applications · github:opencontainers/runc
  • From 1.1.0-rc.1 before 1.3.7
  • From 1.4.0-rc.1 before 1.4.4
  • From 1.5.0-rc.1 before 1.5.3
  • From 1.6.0-rc.1 before 1.6.0-rc.2

References