CVE-2026-64777
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Risk Assessment
This could lead to disclosure of sensitive files from the host system that should not be accessible within the build context.
Recommendation
Upgrade the container to version 1.2.0 or later, which includes the fix.
Other vulnerabilities in Container
See all- CVE-2026-20613High
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This can allow extracting a file to any user-writable location using relative pathnames. The issue is addressed in container 0.8.0 and containerization 0.21.0.
- CVE-2026-113951Low risk· EPSS 24%
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it.
- CVE-2026-64773High
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
- CVE-2026-28909Medium
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
Original NVD description (English source)
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS