CVE-2025-65105
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Apptainer versions less than 1.4.5 allow a container to disable two forms of the little-used --security option, specifically --security=apparmor:<profile> and --security=selinux:<label>, which otherwise restrict container operations. The --security option is documented as a root feature, but these forms also work for unprivileged users on systems where the corresponding feature is enabled. The vulnerability is fixed in 1.4.5.
Risk Assessment
A container can bypass AppArmor or SELinux security mechanisms, potentially allowing operations beyond intended restrictions and increasing the risk of privilege escalation or container isolation breach.
Recommendation
Update Apptainer to version 1.4.5 or later. Review whether the --security option is used in your environment and consider restricting its use by unprivileged users.
Other vulnerabilities in Apptainer
See all- CVE-2026-48785Medium
Apptainer before version 1.5.1 has a vulnerability in Image.AuthorizedPath that applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local user can consequently run a container from a directory outside the administrator's intended allowlist when Apptainer operates in setuid mode.
- CVE-2023-38496Medium
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, allowing subsequent functions to be called with root privileges.
Original NVD description (English source)
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS