CVE-2026-41579

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

• CWE-61

• https://github.com/opencontainers/runc/commit/864db8042dbbPatch
• https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47Mitigation, Patch, Vendor Advisory

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41571Note Mark is an open-source note-taking application. In vers…9.4
• CVE-2026-41572Note Mark is an open-source note-taking application. Prior t…5.3
• CVE-2026-41574Nhost is an open source Firebase alternative with GraphQL. P…9.8
• CVE-2026-41575In th30d4y/IP from version 1.0.1 to before version 2.0.1, a …6.1
• CVE-2026-41576Brave CMS is an open-source CMS. Prior to commit 6c56603, th…7.1
• CVE-2026-41577authentik is an open-source identity provider. Prior to vers…7.5
• CVE-2026-4158KeePassXC OpenSSL Configuration Uncontrolled Search Path Ele…7.3
• CVE-2026-41580Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-41581Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-41583ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-41584ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-41585ZEBRA is a Zcash node written entirely in Rust. From zebrad …6.5