CVE-2026-64777
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Risk Assessment
This could lead to disclosure of sensitive files from the host system that should not be accessible within the build context.
Recommendation
Upgrade the container to version 1.2.0 or later, which includes the fix.
Other vulnerabilities in Container
See all- CVE-2026-20613High
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This can allow extracting a file to any user-writable location using relative pathnames. The issue is addressed in container 0.8.0 and containerization 0.21.0.
- CVE-2026-64773High
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
Original NVD description (English source)
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.