● Cloud-Native · April 2026

Kubernetes Security Advisory: April 2026 runc 'Leaky Vessels' Breakout Triage

Technical triage of the landmark Leaky Vessels runc container breakout (CVE-2024-21626) affecting Docker, Kubernetes, and containerd.

Container Runtimes

Landmark Host Breakout

8.6

CVSS runc Flaw

Critical

Worldwide Infrastructure

セキュリティトリアージとリスク評価

The cloud-native ecosystem deployed emergency patches for CVE-2024-21626 (*Leaky Vessels*) in runc. An internal file descriptor pointing to /proc/self/cwd on the host leaked into the container process, allowing complete host filesystem breakout.

優先脆弱性トリアージマトリックス

CVE識別番号	対象サブシステム / コンポーネント	影響範囲	CVSS	ゼロデイ悪用確認？
CVE-2024-21626	runc / containerd	Container Host Breakout	8.6 High	YES (In-The-Wild)
CVE-2024-21627	BuildKit Image Builder	Privilege Escalation	7.8 High	No
CVE-2024-21628	Docker Daemon Engine	Shared Memory Leak	6.2 Medium	No

注目ソースコード分析

Deep Dive: runc 'Leaky Vessels' Container Breakout Teardown →

Inspect the Go commit in libcontainer/init_linux.go ensuring all internal /proc file descriptors are strictly closed with O_CLOEXEC before execve.

← セキュリティディレクトリ一覧すべてのセキュリティ更新情報 →