Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-48785Apptainer: Incorrect path matching for 'limit container paths' directive

Medium 4.8

In plain English

A medium-severity path traversal in apptainer from apptainer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.1%top 95.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local user can consequently run a container from a directory outside the administrator's intended allowlist when Apptainer operates in setuid mode. Installations that do not use setuid mode or do not configure limit container paths are not affected, and unrestricted user namespaces already allow users to run containers of their choice. This issue is fixed in version 1.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24apptainer1.5.1-r0ALPINE-CVE-2026-48785
Debian:14apptainerno fix listedDEBIAN-CVE-2026-48785
Gogithub.com/apptainer/apptainer1.5.1GHSA-cr2j-534f-mf3g
Gogithub.com/apptainer/apptainer1.5.1GO-2026-5805
Ubuntu:25.10apptainerno fix listedUBUNTU-CVE-2026-48785
Ubuntu:26.04:LTSapptainerno fix listedUBUNTU-CVE-2026-48785
Ubuntu:26.10apptainerno fix listedUBUNTU-CVE-2026-48785

Affected products (as reported)

VendorProductVersions
apptainer apptainer < 1.5.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References