Buildah and Podman build: a crafted Containerfile mounts the host root into the RUN step

Impact

A Containerfile can name as a mount source a dummy image containing a symlink to the root filesystem; the mount then resolves on the host, giving the RUN step read-write access to the host's root. Anyone whose build input you accept gets full container escape at build time - on a build host that means host root, and with it the kubelet credentials, registry secrets and signing keys that live there. GPU operators feel this where image builds run on or beside the fleet: a CI runner or developer node that builds CUDA and inference images with Podman or Buildah turns an untrusted Containerfile into node compromise, and if that host also schedules GPU pods the attacker lands next to other tenants' work.

Who can reach it

Local: anyone who can submit a Containerfile to a build performed by an affected Buildah or Podman, including an unprivileged user and a CI job that builds from a repository. Requires that the build actually be run (the CVSS vector marks user interaction).

What to do

Update buildah and podman from your distribution - Red Hat shipped fixes in RHSA-2024:2049/2055/2064/2066/2077 for RHEL 8 and 9 and OpenShift Container Platform 4.12. Package update plus restarting or re-running builds; no node reboot. Until patched, do not build untrusted Containerfiles on hosts that matter, and move builds to a throwaway VM rather than a cluster node.

References

Related entries

• runc: "Leaky Vessels": internal file descriptor leak lets a container process start with cwd in the host filesystemCVE-2024-21626 · runcHigh
• Envoy proxy (ext_authz filter): When Envoy's ext_authz filter is configured with failure_mode_allow set to trueCVE-2024-23324 · Envoy proxy (ext_authz filter)High
• Contrast: flawed CopyFile policy check lets the untrusted host write arbitrary files into the confidential guestCVE-2026-100838 · Contrast confidential-computing runtime for Kubernetes (generated Kata agent CopyFile policy)High
• Argo CD Helm chart: no network policies by default, so any pod on the cluster can reach repo-serverCVE-2026-62185 · Argo CD Helm chart (argo-helm, default NetworkPolicy set)High
• OSAC operator: unsanitized kubeconfig Secret runs an exec credential plugin as the console-proxy podCVE-2026-62284 · OSAC operator (console-proxy RemoteConfigResolver kubeconfig handling)High
• Harbor (harbor-helm, default core.secretName JWT signing key): SUPPLY CHAIN, UNAUTHENTICATED REGISTRY ACCESS: HarborNCVD-2023-011-harbor-harbor-helm-default-core · Harbor (harbor-helm, default core.secretName JWT signing key)High