---
id: CVE-2026-113951
title: >-
  If an attacker can write to the filesystem of a container k8s cluster
  container, they can plant an exec credential plugin in
  /etc/kubernetes/admin.conf
summary: >-
  If an attacker can write to the filesystem of a container k8s cluster
  container, they can plant an exec credential plugin in
  /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host
  user the next time someone pulls the …
severity: none
vendor: Apple
product: Container
affected:
  - Container < 1.5.0
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:57:20.150Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113951'
references:
  - url: 'https://github.com/apple/container/security/advisories/GHSA-44v5-vx46-ghv6'
tags:
  - cve.org
ingestedAt: '2026-10-23T21:38:13.056Z'
---

## Overview

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.

## Affected

- `Container < 1.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.