CVE-2026-47766

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47766
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47766.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47766
Aliases
  • GHSA-7vwr-4279-7gq5
Downstream
Related
Published
2026-08-14T16:16:37.525Z
Modified
2026-08-16T03:48:29.822406720Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
crun follows rootfs /dev symlink while creating default devices
Details

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without O_NOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named ptmx in the target directory was also replaced by crun's forced ptmx -> pts/ptmx symlink. Version 1.28 fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-61"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47766.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/containers/crun

Affected ranges

Type
GIT
Repo
https://github.com/containers/crun
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
54f16ffbefcd022bf032af768b5c5ce075c18bfc
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.28"
        }
    ]
}

Affected versions

0.*
0.10
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.12.1
0.4
0.5
0.6
0.7
0.8
0.9
0.9.1
1.*
1.0
1.27
1.5
v0.*
v0.2
v0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47766.json"