File System Access Vulnerability in Apple Container for Kubernetes
CVE-2026-113951

Currently unrated

Key Information:

Vendor

Apple
Status
Container
Vendor
CVE Published:
23 October 2026

What is CVE-2026-113951?

A critical security issue exists in the Apple Container for Kubernetes that allows an attacker with filesystem write access to a container to plant an executable credential plugin in the Kubernetes configuration file. This vulnerability means that the next time a host user pulls the cluster's kubeconfig, they may unknowingly execute arbitrary commands as the host user, effectively compromising the system's security. This issue is addressed in Apple Container version 1.5.0.

Affected Version(s)

Container 0 < 1.5.0

References

https://github.com/apple/container/security/advisories/GH...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.