StackRadar

CVE-2025-52565

High

Advisory

Published 5 Nov 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
289
of 17,781 indexed, latest versions
Container images
224
deployed by those charts
Fix available
1 of 2
affected packages

runc container escape with malicious config due to /dev/console mount and related races

Carried by container images the latest versions of 289 of 17,781 indexed charts deploy, on 224 images.

Affected packageAffected versionsFixed inImages
runcdeb1.1.5+ds1-1+deb12u1no fix listed9
github.com/opencontainers/runcgolangv1.0.0-rc6.0.20190115182101-c1e454b2a1bf, v1.0.0-rc8, v1.0.0-rc8.0.20190926150303-84373aaa560b, v1.0.0-rc9+29 more1.2.8215
OSV records
DEBIAN-CVE-2025-52565GHSA-qw9x-cqr3-wc7r
Also known as
GO-2025-4097

Charts affected

289 by stars
ChartLatestAffected imagesRadar Score
act-runnergringolitoVerified publisher0.2.01 of 1See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

2,590
hdx-oss-v2hdx-oss-v20.8.41 of 5See more

hdx-oss-v2 hdx-oss-v2 0.8.4

1 of the 5 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mongo:5.0.14-focal50cae5081ab4
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

6,708
helm-airportshelm-airports0.1.01 of 7See more

helm-airports helm-airports 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

12,696
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,547
helm-airportshelm-airports-dan0.1.01 of 7See more

helm-airports helm-airports-dan 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,573
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,547
dregsyhelm-charts-nr0.1.51 of 1See more

dregsy helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
xelalex/dregsy:0.4.3574054e1c417
github.com/opencontainers/runc@v1.1.1
1.2.8

Open the chart page →

2,969
dbapphelmcourseVerified publisher0.3.31 of 2See more

dbapp helmcourse 0.3.3

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,971
mysqlhelmcourseVerified publisher0.2.41 of 1See more

mysql helmcourse 0.2.4

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

1,518
printserverhmediadeVerified publisher1.0.21 of 4See more

printserver hmediade 1.0.2

1 of the 4 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.9.5b3aba22b1da8
github.com/opencontainers/runc@v1.1.10
1.2.8

Open the chart page →

10,839
honeydipperhoneydipperVerified publisher0.1.111 of 2See more

honeydipper honeydipper 0.1.11

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/redis:5fc5ecd863862
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

1,731
eoloplanthttpd-eoloplant0.1.01 of 7See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:8.0.28fc77d54cacef
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

32,205
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:9.6caddd35b05cd
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

57,669
ingress-nginxifmethod-helm-charts4.12.11 of 2See more

ingress-nginx ifmethod-helm-charts 4.12.1

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.12.1d2fbc4ec70d8
github.com/opencontainers/runc@v1.2.6
1.2.8

Open the chart page →

1,476
eoloserverihuertas2021-vmartinp2021-helm0.1.01 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:8.0.28fc77d54cacef
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

27,721
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

1,384
janus-shieldjanus-shield1.0.01 of 2See more

janus-shield janus-shield 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/cilium/tetragon:v1.1.096fac2482898
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

2,380
ingress-nginxjfrog4.5.21 of 2See more

ingress-nginx jfrog 4.5.2

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.6.415be4666c530
github.com/opencontainers/runc@v1.1.4
1.2.8

Open the chart page →

3,798
missing-container-metricsjimdo-missing-container-metrics0.5.01 of 1See more

missing-container-metrics jimdo-missing-container-metrics 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
dmilhdef/missing-container-metrics:v0.21.0fada1a6e7638
github.com/opencontainers/runc@v1.0.0-rc93
1.2.8

Open the chart page →

2,409
time-series-storagejtektVerified publisher0.1.101 of 2See more

time-series-storage jtekt 0.1.10

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

16,600
librephotosk8sonlabVerified publisher1.1.61 of 7See more

librephotos k8sonlab 1.1.6

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
alpine/k8s:1.22.600ac10bcb759
github.com/opencontainers/runc@v1.0.2
1.2.8

Open the chart page →

14,801
mysqldumpkfirfer2.8.01 of 1See more

mysqldump kfirfer 2.8.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
kfirfer/gcloud-mysql:1.0.3c257c1e0e8b9
github.com/opencontainers/runc@v1.1.9
1.2.8

Open the chart page →

3,507
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/opencontainers/runc@v1.1.3
1.2.8

Open the chart page →

19,168
kimai-helmchartkimai2tet0.1.01 of 2See more

kimai-helmchart kimai2tet 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

1,518
ingress-nginxkomailo-helm-charts1.0.01 of 2See more

ingress-nginx komailo-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

1,547
cadvisorkrakazyabraVerified publisher1.0.11 of 1See more

cadvisor krakazyabra 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gcr.io/cadvisor/cadvisor:v0.40.0135327c978de
github.com/opencontainers/runc@v1.0.0-rc95
1.2.8

Open the chart page →

3,176
krakenkraken0.2.01 of 7See more

kraken kraken 0.2.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/redis:5.0fc5ecd863862
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

1,731
postgresql-backup-to-miniokrzwiatrzyk0.0.11 of 2See more

postgresql-backup-to-minio krzwiatrzyk 0.0.1

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:14.13162a6ead070
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

2,199
cluster-componentkubebb0.2.21 of 4See more

cluster-component kubebb 0.2.2

1 of the 4 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
kubebb/ingress-nginx-controller:v1.3.0067673df26a6
github.com/opencontainers/runc@v1.1.3
1.2.8

Open the chart page →

8,160
ingress-nginxkubebb4.7.01 of 2See more

ingress-nginx kubebb 4.7.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.8.0744ae2afd433
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

3,099
chaos-meshkubeblocksVerified publisher2.7.23 of 4See more

chaos-mesh kubeblocks 2.7.2

3 of the 4 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-daemon:v2.7.29608d9b51452
github.com/opencontainers/runc@v1.1.12
1.2.8
ghcr.io/chaos-mesh/chaos-dashboard:v2.7.211cdbbc479b3
github.com/opencontainers/runc@v1.1.12
1.2.8
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

13,497
ingress-nginxkubeblocksVerified publisher4.12.11 of 2See more

ingress-nginx kubeblocks 4.12.1

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.12.1d2fbc4ec70d8
github.com/opencontainers/runc@v1.2.6
1.2.8

Open the chart page →

1,476
gitlabkubesphereVerified publisher4.2.31 of 17See more

gitlab kubesphere 4.2.3

1 of the 17 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gitlab/gitlab-runner:alpine-v13.2.1fd7e5dfb9f30
github.com/opencontainers/runc@v1.0.0-rc6.0.20190115182101-c1e454b2a1bf
1.2.8

Open the chart page →

38,133
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

17,798
chaos-meshkubesphere-stable2.5.13 of 3See more

chaos-mesh kubesphere-stable 2.5.1

3 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-daemon:v2.5.1cf78fdf7403a
github.com/opencontainers/runc@v1.1.2
1.2.8
ghcr.io/chaos-mesh/chaos-dashboard:v2.5.1448cb346b12c
github.com/opencontainers/runc@v1.1.2
1.2.8
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

8,555
cranekubesphere-stable0.5.22 of 3See more

crane kubesphere-stable 0.5.2

2 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
gocrane/crane-scheduler:0.0.239ba6d11b2079
github.com/opencontainers/runc@v1.0.2
1.2.8
gocrane/craned:v0.5.1a1400909118c
github.com/opencontainers/runc@v1.0.2
1.2.8

Open the chart page →

8,883
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
deepflowce/mysql:8.0.313d7ae561cf60
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

18,316
edgemeshkubesphere-stable0.1.01 of 2See more

edgemesh kubesphere-stable 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
kubeedge/edgemesh-agent:latest460c6061b608
github.com/opencontainers/runc@v1.0.3
1.2.8

Open the chart page →

4,096
kube-wordpress-mysqlkube-wordpress-mysql0.1.01 of 2See more

kube-wordpress-mysql kube-wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

8,698
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
github.com/opencontainers/runc@v1.2.0
1.2.8

Open the chart page →

20,204
kuperatorkusionstackVerified publisher0.7.41 of 1See more

kuperator kusionstack 0.7.4

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
kusionstack/kuperator:v0.7.4d2f72ae1d2f2
github.com/opencontainers/runc@v1.0.2
1.2.8

Open the chart page →

978
operatingkusionstackVerified publisher0.5.11 of 1See more

operating kusionstack 0.5.1

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
kusionstack/operating:v0.5.0c28bd96b986b
github.com/opencontainers/runc@v1.0.2
1.2.8

Open the chart page →

1,879
dynatrace-operatorkvalitetsitVerified publisher1.3.01 of 1See more

dynatrace-operator kvalitetsit 1.3.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
public.ecr.aws/dynatrace/dynatrace-operator:v1.3.0f68901a54664
github.com/opencontainers/runc@v1.1.13
1.2.8

Open the chart page →

1,286
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/opencontainers/runc@v1.1.3
1.2.8

Open the chart page →

4,271
devpod-proloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

3,225
devspace-cloudloftVerified publisher0.3.31 of 8See more

devspace-cloud loft 0.3.3

1 of the 8 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:115d2aa4a7b5f9
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

9,880
vcluster-control-planeloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

3,225
vcluster-proloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
rancher/k3s:v1.26.0-k3s19380f5dbae9a
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

5,085
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
github.com/opencontainers/runc@v1.1.4
1.2.8

Open the chart page →

5,768
nightingalelogic3579Verified publisher0.3.11 of 6See more

nightingale logic3579 0.3.1

1 of the 6 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

8,938

Container images carrying it

224 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
github.com/opencontainers/runc@v1.0.0-rc91
1.2.8
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/opencontainers/runc@v1.1.5
1.2.8
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/opencontainers/runc@v1.0.0-rc9
1.2.8
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/opencontainers/runc@v1.1.5
1.2.8
1
quay.io/openshift/origin-cli:4.66722d5041b47
github.com/opencontainers/runc@v1.0.0-rc91.0.20200707015106-819fcc687efb
1.2.8
1
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
github.com/opencontainers/runc@v1.0.0-rc8.0.20190926150303-84373aaa560b
1.2.8
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/opencontainers/runc@v1.1.10
1.2.8
1
quay.io/operator-framework/olm1b6002156f56
github.com/opencontainers/runc@v1.1.12
1.2.8
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/opencontainers/runc@v1.0.1
1.2.8
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/opencontainers/runc@v1.0.0-rc9
1.2.8
1
quay.io/skopeo/stable:v1.134853591bd1d2
github.com/opencontainers/runc@v1.1.7
1.2.8
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
github.com/opencontainers/runc@v1.0.2
1.2.8
1
registry.k8s.io/csi-vsphere/driver:v3.4.0f5349a8ae3f3
github.com/opencontainers/runc@v1.1.13
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.6.415be4666c530
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.10.042b3f0e5d084
github.com/opencontainers/runc@v1.1.12
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.3.154f7fe2c6c5a
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.2.15516d103a9c2
github.com/opencontainers/runc@v1.1.2
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.8.0744ae2afd433
github.com/opencontainers/runc@v1.1.7
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.7.07612338342a1
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.3.0d1707ca76d3b
github.com/opencontainers/runc@v1.1.3
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
github.com/opencontainers/runc@v1.1.14
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
github.com/opencontainers/runc@v1.1.12
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
github.com/opencontainers/runc@v1.2.3
1.2.8
1
registry.k8s.io/nfd/node-feature-discovery:v0.16.619ebca8b3804
github.com/opencontainers/runc@v1.1.14
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.