{"id":"CVE-2026-113951","title":"If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf","summary":"If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the …","severity":"none","vendor":"Apple","product":"Container","affected":["Container < 1.5.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T20:57:20.150Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113951","references":[{"url":"https://github.com/apple/container/security/advisories/GHSA-44v5-vx46-ghv6"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T21:38:13.056Z","slug":"CVE-2026-113951","body":"## Overview\n\nIf an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.\n\n## Affected\n\n- `Container < 1.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}