StackRadar

CVE-2025-52565

High

Advisory

Published 5 Nov 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
289
of 17,781 indexed, latest versions
Container images
224
deployed by those charts
Fix available
1 of 2
affected packages

runc container escape with malicious config due to /dev/console mount and related races

Carried by container images the latest versions of 289 of 17,781 indexed charts deploy, on 224 images.

Affected packageAffected versionsFixed inImages
runcdeb1.1.5+ds1-1+deb12u1no fix listed9
github.com/opencontainers/runcgolangv1.0.0-rc6.0.20190115182101-c1e454b2a1bf, v1.0.0-rc8, v1.0.0-rc8.0.20190926150303-84373aaa560b, v1.0.0-rc9+29 more1.2.8215
OSV records
DEBIAN-CVE-2025-52565GHSA-qw9x-cqr3-wc7r
Also known as
GO-2025-4097

Charts affected

289 by stars
ChartLatestAffected imagesRadar Score
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/opencontainers/runc@v1.2.1
1.2.8

Open the chart page →

23,894
dagsterdagsterVerified publisher1.13.221 of 5See more

dagster dagster 1.13.22

1 of the 5 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:14.6f565573d74ae
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,455
keydbenapter0.48.01 of 1See more

keydb enapter 0.48.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
eqalpha/keydb:x86_64_v6.3.2fd9351ce27a7
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,552
grafana-agentgrafana0.44.21 of 2See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
grafana/agent:v0.44.23364714a2f64
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

3,475
vclusterloftVerified publisher0.0.0-ci.31 of 2See more

vcluster loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
rancher/k3s:v1.26.0-k3s19380f5dbae9a
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

2,453
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
milvusdb/etcd:3.5.5-r2102aac62827b
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

32,259
nacosygqygq2Verified publisher2.1.101 of 4See more

nacos ygqygq2 2.1.10

1 of the 4 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ygqygq2/mysql-exec-sql:latest54f30def1558
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,983
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.2.15516d103a9c2
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

16,251
aws-cloudwatch-metricsaws0.0.111 of 1See more

aws-cloudwatch-metrics aws 0.0.11

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

1,556
chatwootchatwootVerified publisher2.0.242 of 3See more

chatwoot chatwoot 2.0.24

2 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/redis:6.2.7-debian-11-r37788b908dd0d
github.com/opencontainers/runc@v1.0.1
1.2.8
ghcr.io/chatwoot/pgvector:14.4.0-debian-11-r0f759f1510d09
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

9,203
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

4,167
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/devtron/postgres:14.91b594392f7cb
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

32,902
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:16.109f23e02d766
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

17,245
cadvisorckotzbauerVerified publisher2.4.31 of 1See more

cadvisor ckotzbauer 2.4.3

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gcr.io/cadvisor/cadvisor:v0.52.1f40e65878e25
github.com/opencontainers/runc@v1.2.5
1.2.8

Open the chart page →

961
missing-container-metricsmissing-container-metrics0.1.11 of 1See more

missing-container-metrics missing-container-metrics 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
dmilhdef/missing-container-metrics:v0.21.0fada1a6e7638
github.com/opencontainers/runc@v1.0.0-rc93
1.2.8

Open the chart page →

2,409
rekorsigstoreVerified publisher1.8.51 of 9See more

rekor sigstore 1.8.5

1 of the 9 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gcr.io/trillian-opensource-ci/db_serverdigest-pinned2a685a38dd01
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,415
uffizzi-controlleruffizzi-controller2.4.61 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

1 of the 11 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

14,240
cadvisorcadvisorVerified publisher0.1.151 of 1See more

cadvisor cadvisor 0.1.15

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gcr.io/cadvisor/cadvisor:v0.47.2e6c562b5e983
github.com/opencontainers/runc@v1.1.9
1.2.8

Open the chart page →

1,698
drone-runner-dockerdroneVerified publisher0.7.01 of 3See more

drone-runner-docker drone 0.7.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/docker:20-dindaf96c680a7e1
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

5,674
k8s-image-swapperestahnVerified publisher1.11.01 of 2See more

k8s-image-swapper estahn 1.11.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/estahn/k8s-image-swapper:1.5.102f5be9cde5f9
github.com/opencontainers/runc@v1.1.10
1.2.8

Open the chart page →

1,981
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gcr.io/ml-pipeline/mysql:5.7-debiandf28187b5455
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

96,941
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.9.45b161f051d01
github.com/opencontainers/runc@v1.1.9
1.2.8

Open the chart page →

19,337
eshoponabpabp-charts1.0.02 of 15See more

eshoponabp abp-charts 1.0.0

2 of the 15 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mongo:4.2699d652ed674
github.com/opencontainers/runc@v1.1.0
1.2.8
library/postgres:14.13162a6ead070
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

19,799
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:15.2.0-debian-11-r113e65a6b89e38
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,569
openshift-consoleav1o-chartsVerified publisher0.3.61 of 1See more

openshift-console av1o-charts 0.3.6

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
github.com/opencontainers/runc@v1.0.0-rc8.0.20190926150303-84373aaa560b
1.2.8

Open the chart page →

9,052
backup-zenbzen0.1.41 of 1See more

backup-zen bzen 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
rezachalak/bzen-mongo:1.0.034f694325191
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

7,960
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

24,700
keydbfinkinfridomVerified publisher0.48.31 of 1See more

keydb finkinfridom 0.48.3

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
eqalpha/keydb:x86_64_v6.3.4eceb1806730c
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

5,264
kraken-cikraken-ciVerified publisher1.7.361 of 10See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:115d2aa4a7b5f9
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

7,273
kubeviouskubevious1.2.22 of 7See more

kubevious kubevious 1.2.2

2 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:8.0.303c1aab708f6e
github.com/opencontainers/runc@v1.0.1
1.2.8
redislabs/redisearch:2.4.1433561794c5c8
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

14,204
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

3,793
bentoself-hosters-by-nightVerified publisher0.9.11 of 1See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

1,046
feedbacksystemthm-mni-iiVerified publisher0.47.12 of 10See more

feedbacksystem thm-mni-ii 0.47.1

2 of the 10 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/docker:20.10.21-dind3153fa63f546
github.com/opencontainers/runc@v1.1.3
1.2.8
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

28,534
wallarm-ingresswallarmVerified publisher5.3.10-11 of 2See more

wallarm-ingress wallarm 5.3.10-1

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
wallarm/ingress-controller:5.3.10.1a1fecfdf987e
github.com/opencontainers/runc@v1.2.2
1.2.8

Open the chart page →

1,301
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

14,914
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:3.4.0-debian-11-r6ac64829e45b3
github.com/opencontainers/runc@v1.1.0
1.2.8
bitnamilegacy/zookeeper:3.8.1-debian-11-r6dba59d740e13
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

17,877
mariadbalphani-helm-chartsVerified publisher10.10.31 of 1See more

mariadb alphani-helm-charts 10.10.3

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mariadb:10.10.2bfc25a68e113
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

8,341
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

17,896
dltbrokerassist-iot-distributed-broker0.2.02 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

2 of the 9 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
hyperledger/fabric-peer:2.46ff36af21eb1
github.com/opencontainers/runc@v1.0.0-rc8
1.2.8
hyperledger/fabric-tools:2.4b1194f509085
github.com/opencontainers/runc@v1.0.0-rc8
1.2.8

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.02 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

2 of the 9 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
hyperledger/fabric-peer:2.46ff36af21eb1
github.com/opencontainers/runc@v1.0.0-rc8
1.2.8
hyperledger/fabric-tools:2.4b1194f509085
github.com/opencontainers/runc@v1.0.0-rc8
1.2.8

Open the chart page →

77,687
deployautoml0.1.01 of 3See more

deploy automl 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
amd64/mysql:5.7e20a653e0f51
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

2,947
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

2,898
boundaryboundary-chart0.3.121 of 1See more

boundary boundary-chart 0.3.12

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
hashicorp/boundary:0.15.3339b78b61750
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

1,624
pgbenchcloudnative-pgVerified publisher0.1.01 of 1See more

pgbench cloudnative-pg 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:14.5b3b30d04b362
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

2,713
dregsydeliveryheroVerified publisher0.1.51 of 1See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
xelalex/dregsy:0.4.3574054e1c417
github.com/opencontainers/runc@v1.1.1
1.2.8

Open the chart page →

2,969
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/opencontainers/runc@v1.1.3
1.2.8

Open the chart page →

5,598
docker-in-dockerdocker-in-docker0.0.31 of 2See more

docker-in-docker docker-in-docker 0.0.3

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/docker:24.0.2-dind1d148deae16a
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

2,576
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/containerd/nydus-snapshotter:v0.9.056f8617363b4
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

18,376
nydus-snapshotterdragonflyVerified publisher0.0.101 of 2See more

nydus-snapshotter dragonfly 0.0.10

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/containerd/nydus-snapshotter:v0.9.056f8617363b4
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

3,658
elchi-stackelchi1.13.02 of 10See more

elchi-stack elchi 1.13.0

2 of the 10 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mongo:6.0.12646902910d6a
github.com/opencontainers/runc@v1.1.0
1.2.8
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/opencontainers/runc@v1.1.9
1.2.8

Open the chart page →

15,383

Container images carrying it

224 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
github.com/opencontainers/runc@v1.0.0-rc91
1.2.8
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/opencontainers/runc@v1.1.5
1.2.8
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/opencontainers/runc@v1.0.0-rc9
1.2.8
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/opencontainers/runc@v1.1.5
1.2.8
1
quay.io/openshift/origin-cli:4.66722d5041b47
github.com/opencontainers/runc@v1.0.0-rc91.0.20200707015106-819fcc687efb
1.2.8
1
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
github.com/opencontainers/runc@v1.0.0-rc8.0.20190926150303-84373aaa560b
1.2.8
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/opencontainers/runc@v1.1.10
1.2.8
1
quay.io/operator-framework/olm1b6002156f56
github.com/opencontainers/runc@v1.1.12
1.2.8
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/opencontainers/runc@v1.0.1
1.2.8
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/opencontainers/runc@v1.0.0-rc9
1.2.8
1
quay.io/skopeo/stable:v1.134853591bd1d2
github.com/opencontainers/runc@v1.1.7
1.2.8
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
github.com/opencontainers/runc@v1.0.2
1.2.8
1
registry.k8s.io/csi-vsphere/driver:v3.4.0f5349a8ae3f3
github.com/opencontainers/runc@v1.1.13
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.6.415be4666c530
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.10.042b3f0e5d084
github.com/opencontainers/runc@v1.1.12
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.3.154f7fe2c6c5a
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.2.15516d103a9c2
github.com/opencontainers/runc@v1.1.2
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.8.0744ae2afd433
github.com/opencontainers/runc@v1.1.7
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.7.07612338342a1
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.3.0d1707ca76d3b
github.com/opencontainers/runc@v1.1.3
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
github.com/opencontainers/runc@v1.1.14
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
github.com/opencontainers/runc@v1.1.12
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
github.com/opencontainers/runc@v1.2.3
1.2.8
1
registry.k8s.io/nfd/node-feature-discovery:v0.16.619ebca8b3804
github.com/opencontainers/runc@v1.1.14
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.