CVE-2026-47766
Received Received - Intake

crun OCI Runtime Symlink Following Arbitrary File Creation

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named `ptmx` in the target directory was also replaced by crun's forced `ptmx -> pts/ptmx` symlink. Version 1.28 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-47766
EUVD
EUVD-2026-58714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
containers crun to 1.28 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects crun, an OCI Container Runtime, where versions before 1.28 follow symbolic links in the container's rootfs /dev directory without the O_NOFOLLOW flag. This allows malicious symlinks to redirect device setup outside the container rootfs, creating device nodes and symlinks in unintended system directories.

Detection Guidance

Check if crun version is below 1.28 using 'crun --version'. Inspect OCI bundles for rootfs/dev symlinks and verify device node creation outside containers during runtime.

Impact Analysis

An attacker could exploit this to create device nodes or symlinks outside the container, potentially modifying system files like ptmx. This could lead to unauthorized access or system instability, especially in rootful crun replay scenarios.

Mitigation Strategies

Upgrade crun to version 1.28 or later. Review OCI bundle configurations to ensure /dev is properly mounted and avoid symlink-based rootfs/dev directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart