CVE-2026-113951: Container vulnerability

Q: Which Container versions are affected?

The issue is addressed in Container version 1.5.0. Systems running an earlier version should be treated as affected.

Q: What does an attacker need to exploit this issue?

The attacker must be able to write to the filesystem of a Kubernetes cluster container. They can then place an exec credential plugin in /etc/kubernetes/admin.conf.

Q: When does code execution occur on the macOS host?

Execution occurs when a user transfers the cluster kubeconfig to the host using container k8s write-config or create, and subsequently runs kubectl using that kubeconfig. The planted plugin runs as the macOS host user running kubectl.

Q: What should be done if the cluster container may have been writable by an untrusted party?

Update Container to version 1.5.0. Treat kubeconfig files exported from potentially untrusted cluster containers as unsafe, since they may contain a malicious exec credential plugin.

Published Oct 23, 2026

Updated

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.

Affected Software

1 affected component

container<1.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Container to a version that resolves this vulnerability.
Fixed in 1.5.0

Event History

Oct 23, 2026

CVE Published

via MITRE·08:57 PM

Data Sourced

via MITRE·08:57 PM

DescriptionWeakness

Frequently Asked Questions

Which Container versions are affected?

The issue is addressed in Container version 1.5.0. Systems running an earlier version should be treated as affected.

What does an attacker need to exploit this issue?

The attacker must be able to write to the filesystem of a Kubernetes cluster container. They can then place an exec credential plugin in /etc/kubernetes/admin.conf.

When does code execution occur on the macOS host?

Execution occurs when a user transfers the cluster kubeconfig to the host using container k8s write-config or create, and subsequently runs kubectl using that kubeconfig. The planted plugin runs as the macOS host user running kubectl.

What should be done if the cluster container may have been writable by an untrusted party?

Update Container to version 1.5.0. Treat kubeconfig files exported from potentially untrusted cluster containers as unsafe, since they may contain a malicious exec credential plugin.

CVE-2026-113951: Container vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Container versions are affected?

What does an attacker need to exploit this issue?

When does code execution occur on the macOS host?

What should be done if the cluster container may have been writable by an untrusted party?

Company

Resources

Contact

Frequently Asked Questions

Which Container versions are affected?

What does an attacker need to exploit this issue?

When does code execution occur on the macOS host?

What should be done if the cluster container may have been writable by an untrusted party?