Every CVE Search/ Get API key

CVE-2026-88264

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

5.6 MediumFix available

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.12%Unchanged since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.6

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2026-75327 5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
EUVD-2026-75327
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-ppgw-cqj8-9qrg 5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount,...

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
GHSA-ppgw-cqj8-9qrg
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
NVD 5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
OSVALPINE-CVE-2026-88264 5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
ALPINE-CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-88264 5.6
Record
BELL-CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSV 5.6

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88264 5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
DEBIAN-CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:71668 5.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:71668
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88264 5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
UBUNTU-CVE-2026-88264
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-101099 No score

CVE-2026-88264 affecting package crun 1.24-6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
AZL-101099
Updated
2026-11-02
OSVopenSUSE-SU-2026:12162-1 No score

crun-1.30.1-1.1 on GA media

These are all security issues fixed in the crun-1.30.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12162-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
crun
Alpine:v3.24
 before 1.30.1-r0
1.30.1-r0
crun
Azure Linux:3
 through 1.24-6 None known
crun
Alpaquita:23
 1.7-r0 up to 1.17-r2
1.17-r2
crun
Alpaquita:25
 1.21-r0 up to 1.23.1-r2
1.23.1-r2
crun
Alpaquita:stream
 1.8.5-r0 up to 1.30.1-r0
1.30.1-r0
crun
Debian:12
 All versions, plus listed versions
1.10-11.11-11.11.1-11.12-11.13-1
Show 26 moreShow less
1.14-11.14.1-11.14.4-11.15-11.16-11.16.1-11.17-11.18-11.18.1-11.18.2-11.19.1-11.20-11.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-11.8.1-11.8.1-1+deb12u11.8.5-11.8.6-11.8.7-11.9-1
 None known
crun
Debian:13
 All versions, plus listed versions
1.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-1
 None known
crun
Debian:14
 All versions, plus listed versions
1.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-1
 None known
crun
Red Hat:hummingbird:1
 before 0:1.30-1.hum1
0:1.30-1.hum1
crun-krun
Red Hat:hummingbird:1
 before 0:1.30-1.hum1
0:1.30-1.hum1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
crun-wasm
Red Hat:hummingbird:1
 before 0:1.30-1.hum1
0:1.30-1.hum1
crun
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.5+dfsg-10.10.6+dfsg-10.11+dfsg-10.12+dfsg-10.12.1+dfsg-1
 None known
crun
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.17+dfsg-10.17+dfsg-1.10.17+dfsg-1.1ubuntu0.1
 None known
crun
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.8.5-11.11-11.11.1-11.12-11.13-11.14-11.14.1-1
 None known
crun
Ubuntu:26.10
 All versions, plus listed versions
1.21-1ubuntu3
 None known
crun
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.21-1ubuntu21.21-1ubuntu3
 None known
crun
openSUSE:Tumbleweed
 before 1.30.1-1.1
1.30.1-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88264 is a medium vulnerability (CVSS 5.6) in Containers Crun, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in crun 1.30.1-r0.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open