CVE-2026-88264

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-88264

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88264.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-88264

Downstream

Published

2026-09-10T08:40:36Z

Modified

2026-09-26T11:47:28Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

Details

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Database specific

{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88264.json"
}

References

Affected packages

Git / github.com/containers/crun

Affected ranges

Type

GIT

Repo

https://github.com/containers/crun

Events

Introduced

Last Affected

f0d911de5587342cfeb16473bf32ecdfeaf25957

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.29.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.10

0.10.1

0.10.2

0.10.3

0.10.4

0.10.5

0.10.6

0.12.1

0.4

0.5

0.6

0.7

0.8

0.9

0.9.1

1.*

1.0

1.27

1.29.1

1.5

v0.*

v0.2

v0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88264.json"