CVE-2026-113951
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an…
- Risk score
- 62/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and t…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.8 high
- On your watchlist: kubernetes
References
Original description
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.
Last activity 23 Oct 2026. Patch Forecast updates every hour.