CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local user can consequently run a container from a directory outside the administrator's intended allowlist when Apptainer operates in setuid mode. Installations that do not use setuid mode or do not configure limit container paths are not affected, and unrestricted user namespaces already allow users to run containers of their choice. This issue is fixed in version 1.5.1.

• CWE-22

• https://github.com/apptainer/apptainer/commit/0ff35257420e0c6cb97dac11d305749c893e5214
• https://github.com/apptainer/apptainer/pull/3549
• https://github.com/apptainer/apptainer/releases/tag/v1.5.1
• https://github.com/apptainer/apptainer/security/advisories/GHSA-cr2j-534f-mf3g

Published

Sep 15, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4878A flaw was found in libcap. A local unprivileged user can ex…7
• CVE-2026-48780Forem is open source software for building communities. Prio…8.2
• CVE-2026-48781Postiz is an AI social media scheduling tool. In versions pr…9.9
• CVE-2026-48782Pydantic AI is a Python agent framework for building applica…6.8
• CVE-2026-48783Postiz is an AI social media scheduling tool. Versions prior…4.8
• CVE-2026-48784Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48786Fleet is an open-source device management platform built on …6.5
• CVE-2026-48787gin-vue-admin is an AI-assisted basic development platform. …7.4
• CVE-2026-48788Remark42 is a self-hosted comment engine for blogs, articles…8.2
• CVE-2026-48789AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-4879GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-48790Turso CLI is the command line interface (CLI) to the open-so…5.5