CVE-2026-88264
Received Received - Intake

Container Terminal Setup Flaw in crun Allows Path Redirection

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: redhat-SADP

Description
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88264
EUVD
EUVD-2026-75327

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88264 is a flaw in crun, a lightweight container runtime, affecting versions 1.29.1 and earlier. The vulnerability occurs when a container configuration does not mount /dev separately. This allows terminal setup to redirect /dev/console to an attacker-controlled path, enabling file system traversal and unauthorized file access or modification.

Detection Guidance

Check if crun versions 1.29.1 or earlier are installed by running: crun --version. Inspect container configurations for missing /dev mounts using: podman inspect <container> | grep -A5 mounts. Look for symlinks in /dev/console or attacker-controlled paths.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to files outside the container's root filesystem. This could lead to data theft, modification, or deletion. Exploitation requires a malicious container image and a configuration without a dedicated /dev mount.

Mitigation Strategies

Ensure /dev is always mounted separately in container configurations. Use Podman or crun with default settings that mount /dev. Avoid running untrusted container images until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart