● Cloud-Native · April 2026

Kubernetes Security Advisory: April 2026 runc 'Leaky Vessels' Breakout Triage

Technical triage of the landmark Leaky Vessels runc container breakout (CVE-2024-21626) affecting Docker, Kubernetes, and containerd.

4
Container Runtimes
1
Landmark Host Breakout
8.6
CVSS runc Flaw
Critical
Worldwide Infrastructure

Executive Triage und Risikobewertung

The cloud-native ecosystem deployed emergency patches for CVE-2024-21626 (*Leaky Vessels*) in runc. An internal file descriptor pointing to /proc/self/cwd on the host leaked into the container process, allowing complete host filesystem breakout.

Kuratierte Schwachstellen-Triage-Matrix

CVE-Kennung Subsystem / Komponente Auswirkung CVSS Aktive Ausnutzung?
CVE-2024-21626runc / containerdContainer Host Breakout8.6 HighYES (In-The-Wild)
CVE-2024-21627BuildKit Image BuilderPrivilege Escalation7.8 HighNo
CVE-2024-21628Docker Daemon EngineShared Memory Leak6.2 MediumNo
HERVORGEHOBENE CODE-ANALYSE

Deep Dive: runc 'Leaky Vessels' Container Breakout Teardown →

Inspect the Go commit in libcontainer/init_linux.go ensuring all internal /proc file descriptors are strictly closed with O_CLOEXEC before execve.

← Sicherheitsverzeichnis durchsuchen Alle Sicherheitsupdates →