CVE-2026-47699
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Confidential Containers Guest Components (from 0.16.0 to 0.20.0) allows creating a hardlink outside the destination directory via a crafted OCI image layer, potentially leading to writing data outside the pod VM.
Risk Assessment
Risk of privilege escalation within the pod, enabling access to VM capabilities and attestation abuse.
Recommendation
Update Confidential Containers Guest Components to version 0.20.0 or later, which includes the fix.
Original NVD description (English source)
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs, try_hardlink_fallback() validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path. In Confidential Containers the workload owner already controls trusted image content, so the issue is a workload-owner escape into the pod virtual machine rather than a crossing of the image trust boundary, but it may enable access to pod virtual machine capabilities and attestation abuse. This issue is fixed in version 0.20.0.