CVE-2024-21626

High

Advisory

Published 31 Jan 2024In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.6; base score, highest
EPSS: 0.181; 97th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 226; of 17,781 indexed, latest versions
Container images: 159; deployed by those charts
Fix available: 8 of 8; affected packages

runc vulnerable to container breakout through process.cwd trickery and leaked fds

Carried by container images the latest versions of 226 of 17,781 indexed charts deploy, on 159 images.

Affected package	Affected versions	Fixed in	Images
github.com/opencontainers/runcgolang	v1.0.0-rc93, v1.0.0-rc95, v1.0.1, v1.0.2+11 more	1.1.12	159
containers-commonrpm	2:1-64.module+el8.8.0+18571+eed59fc4	2:1-71.module+el8.9.0+21243+a586538b	1
criurpm	3.15-4.module+el8.8.0+19044+f9982fd8	0:3.18-4.module+el8.9.0+21243+a586538b	1
fuse-overlayfsrpm	1.11-1.module+el8.8.0+18634+9a268292	0:1.12-1.module+el8.9.0+21243+a586538b	1
libslirprpm	4.4.0-1.module+el8.8.0+18060+3f21f2cc	0:4.4.0-1.module+el8.9.0+21243+a586538b	1
runcrpm	1:1.1.4-1.module+el8.8.0+18060+3f21f2cc	1:1.1.12-1.module+el8.9.0+21243+a586538b	1
skopeorpm	2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c	2:1.13.3-3.module+el8.9.0+21243+a586538b	1
slirp4netnsrpm	1.2.0-2.module+el8.8.0+18060+3f21f2cc	0:1.2.1-1.module+el8.9.0+21243+a586538b	1

OSV records: GHSA-xr7r-f8xq-vfvv RHSA-2024:0752
Also known as: GO-2024-2491, RHSA-2024:0759

Charts affected

226 by stars

Chart

Latest

Affected images

Radar Score

devtron-operatorromholdings

0.23.3

1 of 11 See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
quay.io/devtron/postgres :14.9	1b594392f7cb	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

32,902

routehub-serverroutehub-helm

1.0.1

1 of 3 See more

routehub-server routehub-helm 1.0.1

1 of the 3 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
eqalpha/keydb :latest	6537505c4235	github.com/opencontainers/runc@v1.0.1	1.1.12

Open the chart page →

6,890

speedtestsantisbon

0.1.0

1 of 3 See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/influxdb :2.7	b8d940ca9376	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

12,668

searchpesearchpe

4.1.0

1 of 2 See more

searchpe searchpe 4.1.0

1 of the 2 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/postgres :13.7	03652c675ae1	github.com/opencontainers/runc@v1.0.1	1.1.12

Open the chart page →

2,637

backendsignalen

4.24.0

2 of 4 See more

backend signalen 4.24.0

2 of the 4 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql :14.4.0-debian-11-r23	7e7ebb082031	github.com/opencontainers/runc@v1.0.1	1.1.12
bitnamilegacy/rabbitmq :3.10.7-debian-11-r4	cf93e2772250	github.com/opencontainers/runc@v1.0.1	1.1.12

Open the chart page →

11,636

trilliansigstore

0.3.17

1 of 5 See more

trillian sigstore 0.3.17

1 of the 5 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
gcr.io/trillian-opensource-ci/db_serverdigest-pinned	2a685a38dd01	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

2,808

smarter-k3s-edgesmarter

0.0.12

1 of 2 See more

smarter-k3s-edge smarter 0.0.12

1 of the 2 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
rancher/k3s :v1.25.3-k3s1	eaa270df79cc	github.com/opencontainers/runc@v1.1.2	1.1.12

Open the chart page →

3,462

sneakerssneakers

1.0.0

1 of 4 See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
helga09/my_sql_shoes :v1.1.1	a03657d97897	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

7,574

harborsoftonic

1.13.0

1 of 8 See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
goharbor/trivy-adapter-photon :v2.9.0	dc5b882a7db4	github.com/opencontainers/runc@v1.1.5	1.1.12

Open the chart page →

7,672

redissoftonic

0.3.0

1 of 2 See more

redis softonic 0.3.0

1 of the 2 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/redis :5.0	fc5ecd863862	github.com/opencontainers/runc@v1.0.1	1.1.12

Open the chart page →

1,731

redis-high-availabilitysomeblackmagic

1.3.10

1 of 3 See more

redis-high-availability someblackmagic 1.3.10

1 of the 3 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
bitnamilegacy/redis :7.0.8-debian-11-r0	bf01d031ba8c	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

3,148

servicexssl-hep

1.8.5

1 of 16 See more

servicex ssl-hep 1.8.5

1 of the 16 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2022.12.12-debian-11-r9	0f7c8ac484ac	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

66,266

static-src-people-detector-appstatic-src-people-detector-chart

1.5.5

1 of 6 See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/mongo :4.4.18	d23ec07162ca	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

13,646

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

12,655

ingress-nginxsvtech-public-helm-charts

1.0.0

1 of 1 See more

ingress-nginx svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.9.4	5b161f051d01	github.com/opencontainers/runc@v1.1.9	1.1.12

Open the chart page →

1,480

maxscalesvtech-public-helm-charts

1.0.0

1 of 2 See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

5,841

explorersynapse

0.2.16

2 of 6 See more

explorer synapse 0.2.16

2 of the 6 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
yandex/clickhouse-server :latest	1cbf75aabe1e	github.com/opencontainers/runc@v1.0.1	1.1.12
ghcr.io/synapsecns/sanguine/explorer :latest	00131e3d1eaf	github.com/opencontainers/runc@v1.1.5	1.1.12

Open the chart page →

8,518

act-runnertektonops

0.1.2

1 of 2 See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/docker :23.0.6-dind	afa5d5134900	github.com/opencontainers/runc@v1.1.7	1.1.12

Open the chart page →

4,212

tensor_apptensor-app

0.2.2

1 of 3 See more

tensor_app tensor-app 0.2.2

1 of the 3 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

17,461

vehicle-dashboardtest-vehi-dash

0.1.0

1 of 7 See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/mongo :5.0.21	7c81758cb295	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

20,270

thanhvt27-lab-k8sthanh-vt

0.1.4

1 of 5 See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
pysga1996/redis :latest	3af6d0c7db19	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

4,661

steamcmdthetredev

1.0.9

1 of 1 See more

steamcmd thetredev 1.0.9

1 of the 1 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
ghcr.io/thetredev/steamcmd :srcds-20240309	dbb0f042cb31	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

1,075

phonebook-chartusuladams2

0.2.1

1 of 3 See more

phonebook-chart usuladams2 0.2.1

1 of the 3 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

3,176

wallarm-ingress-rcwallarm

4.8.4

1 of 2 See more

wallarm-ingress-rc wallarm 4.8.4

1 of the 2 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
wallarm/ingress-controller :4.8.0-1	a591b9c91570	github.com/opencontainers/runc@v1.1.7	1.1.12

Open the chart page →

2,635

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	github.com/opencontainers/runc@v1.1.0	1.1.12

Open the chart page →

9,248

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2024-21626.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	github.com/opencontainers/runc@v1.1.5	1.1.12

Open the chart page →

2,022

Container images carrying it

159 by charts deploying them

A fixed version is listed for 8 of the 8 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	github.com/opencontainers/runc@v1.0.1	1.1.12	1
quay.io/skopeo/stable :v1.13	4853591bd1d2	github.com/opencontainers/runc@v1.1.7	1.1.12	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	github.com/opencontainers/runc@v1.0.2	1.1.12	1
registry.k8s.io/ingress-nginx/controller :v1.6.4	15be4666c530	github.com/opencontainers/runc@v1.1.4	1.1.12	1
registry.k8s.io/ingress-nginx/controller :v1.3.1	54f7fe2c6c5a	github.com/opencontainers/runc@v1.1.4	1.1.12	1
registry.k8s.io/ingress-nginx/controller :v1.2.1	5516d103a9c2	github.com/opencontainers/runc@v1.1.2	1.1.12	1
registry.k8s.io/ingress-nginx/controller :v1.8.0	744ae2afd433	github.com/opencontainers/runc@v1.1.7	1.1.12	1
registry.k8s.io/ingress-nginx/controller :v1.7.0	7612338342a1	github.com/opencontainers/runc@v1.1.4	1.1.12	1
registry.k8s.io/ingress-nginx/controller :v1.3.0	d1707ca76d3b	github.com/opencontainers/runc@v1.1.3	1.1.12	1