CVE-2024-21626
Published Jan 31, 2024
Last updated a month ago
- Description
- runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
- Source
- security-advisories@github.com
- NVD status
- Modified
- Products
- runc, fedora
CVSS 3.1
- Type
- Primary
- Base score
- 8.6
- Impact score
- 6
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
🔴 Runc, Container Escape, #CVE-2024-21626 (Critical) -DC-Oct2026-3123 https://t.co/kCaGzm6UFG
@dailycve
12 Oct 2026
26 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVEs Explainer #17 CVE-2024-21626 (runc Container Escape) A critical file descriptor leak in runc, the core container runtime, allowed attackers to escape container isolation and gain access to the host filesystem (CVSS 8.6). This vulnerability undermined the fundamental https
@xbhaveshverma
10 Oct 2026
94 Impressions
1 Retweet
1 Like
0 Bookmarks
1 Reply
0 Quotes
Can someone explain to me why people still trust containers? - CVE-2024-21626 (Leaky Vessels) - CVE-2025-23266 (NVIDIAScape, CVSS 9.0, a 3-line Dockerfile) - CVE-2025-52881 (runc procfs write-redirect, actively exploited in the wild by mid-2026). Those are some prominent https:
@JeromeJaggi
10 Jul 2026
31 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
If you're running critical or multi-tenant workloads on containers, you're playing with fire. The CVE record keeps proving it: - CVE-2024-21626 — Leaky Vessels: runc container escape, host filesystem access - CVE-2025-23266 — NVIDIAScape: CVSS 9.0, triggered by a 3-line http
@felipehuici
10 Jul 2026
459 Impressions
0 Retweets
5 Likes
6 Bookmarks
0 Replies
0 Quotes
🚨 HIGH: CVE-2024-21626 (CVSS 8.6) - runc container escape vulnerability in versions ≤1.1.11. Attackers can access host filesystem & overwrite binaries. Update to 1.1.12 immediately. #CVE #Vulnerability #PatchNow https://t.co/DlPne9ygkN
@DFIR_Lab
26 Jun 2026
25 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
¡Acabo de rootear Giveback en @hackthebox_eu! 🚩 🔸 CVE-2024-5932 (GiveWP) → RCE 🔸 CVE-2024-4577 (PHP-CGI) → pivote en K8s 🔸 CVE-2024-21626 (runc) → escape de contenedor → root https://t.co/mF7niWbmNt #HackTheBox #HTB #CVE #Kubernetes #Pentesting #
@cyberknight_91
12 May 2026
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-21626 runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker ... https://t.co/noJR8k56ZX https://t.co/e5nlZwyQvm
@CVEradars
2 Apr 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-21626: runc Container Breakout Vulnerability | Bug-Bounty notes https://t.co/DUsuxW5t8a
@akaclandestine
15 Mar 2026
1351 Impressions
3 Retweets
9 Likes
2 Bookmarks
0 Replies
0 Quotes
New HackTheBox walkthrough: Giveback WordPress RCE → Kubernetes pivoting with Ligolo-ng → PHP-CGI exploitation → runc CVE-2024-21626 container escape to root. Advanced cloud-native pentesting chain. https://t.co/HeG3CoDqRp #HackTheBox #Kubernetes #ContainerEscape
@Strikoder
28 Feb 2026
61 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Spent last week patching a client's network after they ignored CVE-2024-21626 for 3 months. Exploit was in active use for 6 weeks before detection. Patch Tuesday isn't optional, it's your only reliable defense layer. https://t.co/E8QXXKOR3M
@W1ld3W0rk5
13 Jan 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-21626 proves container escapes are real. With osquery + eBPF, detect them in real time—no custom code, just smart SQL + kernel events. Start detecting today 👉 https://t.co/eFMbNN4jp2 #eBPF #Osquery #ContainerSecurity
@uptycs
21 May 2025
8 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D656F217-AB80-4BE5-8CDC-54C53AF3DAA9",
"versionEndExcluding": "1.1.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]