CVE-2026-34009: **Container Escape** Host user home directory mounted with write access into application container
Published Oct 15, 2026
·Updated
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Affected Software
1 affected component
Synology Notes Station 3<3.9.11
Event History
Oct 15, 2026
CVE Published
via MITRE·09:37 AM
Data Sourced
via MITRE·09:37 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires a local attacker who has already obtained an administrator account. The issue affects Notes Station 3 installations prior to version 3.9.11.
2
What is the security impact after exploitation?
A successful exploit can compromise system security through improper isolation between the application container and the host user home directory, which is mounted with write access.
3
What version resolves the vulnerability?
Notes Station 3 version 3.9.11 and later includes a fix.