CVE-2026-64777
Last modified
CVE-2026-64777 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apple | Container | < 1.2.0 |
References
- https://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585Vendor Advisory, Mitigation
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-64777?
How severe is CVE-2026-64777?
How do I fix CVE-2026-64777?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-64771A buffer overflow was addressed with improved bounds checkin…9.8
- CVE-2026-64772An out-of-bounds write issue was addressed with improved inp…9.8
- CVE-2026-64773An attacker that can reach a container's published TCP port …7.5
- CVE-2026-64774An integer overflow was addressed with improved input valida…9.8
- CVE-2026-64775A memory initialization issue was addressed with improved me…9.8
- CVE-2026-64776The issue was addressed with improved bounds checks. This is…5.5
- CVE-2026-64778The issue was addressed with improved checks. This issue is …6.5
- CVE-2026-64779A memory corruption vulnerability was addressed with improve…3.1
- CVE-2026-6478Covert timing channel in comparison of MD5-hashed password i…6.5
- CVE-2026-64780The issue was addressed with improved checks. This issue is …4.3
- CVE-2026-64781The issue was addressed with improved input validation. This…4.3
- CVE-2026-64782A memory corruption vulnerability was addressed with improve…3.1
Are you affected by CVE-2026-64777?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST