● Cloud-Native · April 2026

Kubernetes Security Advisory: April 2026 runc 'Leaky Vessels' Breakout Triage

Technical triage of the landmark Leaky Vessels runc container breakout (CVE-2024-21626) affecting Docker, Kubernetes, and containerd.

Container Runtimes

Landmark Host Breakout

8.6

CVSS runc Flaw

Critical

Worldwide Infrastructure

보안 릴리스 분석 및 위험성 평가

The cloud-native ecosystem deployed emergency patches for CVE-2024-21626 (*Leaky Vessels*) in runc. An internal file descriptor pointing to /proc/self/cwd on the host leaked into the container process, allowing complete host filesystem breakout.

핵심 취약점 트리아지 매트릭스

CVE 식별자	서브시스템 / 구성 요소	영향	CVSS	실제 악용 여부?
CVE-2024-21626	runc / containerd	Container Host Breakout	8.6 High	YES (In-The-Wild)
CVE-2024-21627	BuildKit Image Builder	Privilege Escalation	7.8 High	No
CVE-2024-21628	Docker Daemon Engine	Shared Memory Leak	6.2 Medium	No

주목할 코드 분석

Deep Dive: runc 'Leaky Vessels' Container Breakout Teardown →

Inspect the Go commit in libcontainer/init_linux.go ensuring all internal /proc file descriptors are strictly closed with O_CLOEXEC before execve.

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →