Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
21 versions affected across 18 products
| Date | Total | Labels |
|---|
| 2026-02-26 | 1 | Exploit1 |
| 2026-04-30 | 1 | General1 |
| 2026-05-10 | 3 | General2Patch1 |
| 2026-09-03 | 1 | General1 |
CVE-2026-31431 让我想起22年研究DirtyPipe 的时候，当时容器相关的exploit 方法印象中是两个 1. overlap 去横向打cross container 2. 通过 CVE-2019-5736 的思路去修改 runc https://t.co/b2sOhFTFCf
Post summary
The tweet mentions CVE‑2026‑31431 in the context of container exploits, referencing past DirtyPipe research and CVE‑2019‑5736, but it provides no concrete evidence of exploitation, patches, or technical vulnerability details.
🚨CRITICAL Docker, Kubernates and containerd users are all at risk. A flaw in runc (CVE-2019-5736) lets attackers break out of containers and take over the host without special privileges. Find out more on our website https://cert.gov.ng/advisories/critical-runc-container-escape-vulnerability #Cybersecurity #advisory https://t.co/zZzvKfZdYt
Post summary
The tweet warns that runc CVE‑2019‑5736 can cause container escape and host takeover for Docker, Kubernetes, and containerd users, with a link for more details.
A solid example of Docker isolation failing: CVE-2019-5736 in runc (Docker's default runtime). If the AI agent (running as root, common in sandboxes) drops malicious code that overwrites the host's runc binary via a /proc/self/exe symlink trick during any exec, boom—next 'docker exec' or attach runs the payload on the *host* as root. No mounts or rm -rf needed; pure runtime exploit. Real PoCs from 2019 let attackers fully own the machine. AI code gen could trigger this unintentionally.
Post summary
The post highlights a real-world exploit of CVE-2019-5736 in Docker’s runc, detailing how a symlink trick can overwrite the host binary and achieve root execution, with PoCs from 2019 confirming its effectiveness.
@andersonc0d3 @dinodaizovi Yes, it's /proc/self/exe. It boils down to doing CVE-2019-5736 but via page-cache poisoning. My initial patch for that would create a copy of the binary in a sealed memfd for every container run (meaning a unique instance in the page cache) but we had to switch to something else.
Post summary
The comment discusses a mitigative patch for CVE‑2019‑5736 focused on page‑cache poisoning, but does not mention a PoC, exploit tool, or active exploitation.
@markasoftware_ @D1iv3 There isn't really a way around it, to create a container process you need to join while still executing container runtime code. As I mentioned in another thread, my first version of the protection against CVE-2019-5736 actually protected against page-cache poisoning attacks...
Post summary
The message references defensive measures against CVE-2019-5736 and notes page-cache poisoning as a concern, but offers no PoC, exploit, patch details, or evidence of active exploitation.
@markasoftware_ @D1iv3 This is basically just a page cache poisoning variant of CVE-2019-5736.
Post summary
The tweet simply notes the existence of a page cache poisoning variant of CVE-2019-5736, offering no further detail or actionable information.
38 of 38 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | mesos | - | - | - |
| OS | canonical | ubuntu_linux | 16.04 | - | - |
| OS | canonical | ubuntu_linux | 18.04 | - | - |
| OS | canonical | ubuntu_linux | 18.10 | - | - |
| OS | canonical | ubuntu_linux | 19.04 | - | - |
| OS | d2iq | dc\/os | - | - | - |
| App | d2iq | kubernetes_engine | - | - | - |
| App | docker | docker | - | - | - |
| OS | fedoraproject | fedora | 29 | - | - |
| OS | fedoraproject | fedora | 30 | - | - |
| App | kubernetes_engine | - | - | - | |
| App | hp | onesphere | - | - | - |
| App | linuxcontainers | lxc | - | - | - |
| App | linuxfoundation | runc | - | - | - |
| App | linuxfoundation | runc | 1.0.0 | - | - |
| App | linuxfoundation | runc | 1.0.0 | - | - |
| App | linuxfoundation | runc | 1.0.0 | - | - |
| App | linuxfoundation | runc | 1.0.0 | - | - |
| App | linuxfoundation | runc | 1.0.0 | - | - |
| App | linuxfoundation | runc | 1.0.0 | - | - |
| App | microfocus | service_management_automation | 2018.02 | - | - |
| App | microfocus | service_management_automation | 2018.05 | - | - |
| App | microfocus | service_management_automation | 2018.08 | - | - |
| App | microfocus | service_management_automation | 2018.11 | - | - |
| App | netapp | hci_management_node | - | - | - |
| App | netapp | solidfire | - | - | - |
| App | opensuse | backports_sle | 15.0 | - | - |
| App | opensuse | backports_sle | 15.0 | - | - |
| OS | opensuse | leap | 15.0 | - | - |
| OS | opensuse | leap | 15.1 | - | - |
| OS | opensuse | leap | 42.3 | - | - |
| App | redhat | container_development_kit | 3.7 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux_server | 7.0 | - | - |
| App | redhat | openshift | 3.4 | - | - |
| App | redhat | openshift | 3.5 | - | - |
| App | redhat | openshift | 3.6 | - | - |
| App | redhat | openshift | 3.7 | - | - |