CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices
An attacker with a malicious OCI bundle can escape the container rootfs to create or overwrite device nodes and symlinks on the host filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47766?
CVE-2026-47766 is a medium-severity path traversal vulnerability in containers crun, published on 14 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named `ptmx` in the target directory was also replaced by crun's forced `ptmx -> pts/ptmx` symlink. Version 1.28 fixes the issue.
Weakness: CWE-61
Which versions are affected by CVE-2026-47766?
Linux distribution packages (6)
crun Red Hat:hummingbird:1 | All versions | 0:1.28-2.hum1 |
crun-krun Red Hat:hummingbird:1 | All versions | 0:1.28-2.hum1 |
crun-wasm Red Hat:hummingbird:1 | All versions | 0:1.28-2.hum1 |
crun SUSE:Linux Micro 6.0 | All versions | 1.14-3.1 |
crun SUSE:Linux Micro 6.1 | All versions | 1.15-slfo.1.1_2.1 |
crun openSUSE:Tumbleweed | All versions | 1.28-1.1 |
How do I fix CVE-2026-47766?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47766 being exploited?
There is no known exploitation of CVE-2026-47766 in the wild and no public exploit code.
Sources
Also known as AZL-95985, BELL-CVE-2026-47766, DEBIAN-CVE-2026-47766, GHSA-7vwr-4279-7gq5, RHSA-2026:54855, SUSE-SU-2026:22247-1 and 3 more.