CVE-2026-47766: crun follows rootfs /dev symlink while creating default devices
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named ptmx in the target directory was also replaced by crun's forced ptmx -> pts/ptmx symlink. Version 1.28 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
crunto a version that resolves this vulnerability.Fixed in 1.28
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47766?
The severity of CVE-2026-47766 is rated at 50 on the risk scale.
How do I fix CVE-2026-47766?
To fix CVE-2026-47766, update crun to version 1.28 or later.
What impact does CVE-2026-47766 have on container security?
CVE-2026-47766 can lead to security vulnerabilities if crun follows symlinks, potentially exposing the host filesystem.
Which versions of crun are affected by CVE-2026-47766?
CVE-2026-47766 affects all versions of crun prior to 1.28.
What conditions trigger CVE-2026-47766?
CVE-2026-47766 is triggered when an OCI bundle contains a symlink in the rootfs `/dev` directory and the configuration does not mount `/dev`.