Crun OCI Container Runtime Vulnerability in Device Setup
CVE-2026-47766

5.1MEDIUM

Key Information:

Vendor

Containers

Status
Crun
Vendor
CVE Published:
14 August 2026

What is CVE-2026-47766?

Crun, an open source OCI container runtime, is affected by a vulnerability in its default device setup process. Prior to version 1.28, crun improperly handles symbolic links in its container root filesystem, particularly within the /dev directory. If an OCI bundle includes a symlink for rootfs/dev and does not mount /dev, crun inadvertently follows that symlink, leading to the creation of device nodes and standard input/output symlinks outside of the intended container environment. This behavior can compromise the integrity of the host system, especially if a pre-existing file, such as ptmx, is overwritten by crun's operations. The issue has been addressed in version 1.28, emphasizing the importance of keeping container runtimes up to date for enhanced security.

Affected Version(s)

crun < 1.28

References

https://github.com/containers/crun/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/containers/crun/releases/tag/1.28
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.