CVE-2026-47699 confidential-containers CVE debrief

Who should care

Organizations using Confidential Containers Guest Components, especially those with sensitive workloads or high security requirements, should be aware of this vulnerability. The issue allows a crafted OCI image layer to create a hardlink outside its destination directory, potentially enabling workload-owner escape into the pod virtual machine. This could lead to unauthorized access to pod virtual machine capabilities and attestation abuse. Therefore, it is crucial for these organizations to prioritize updating to version 0.20.0 or later and to review and validate image content before use. Monitoring for suspicious activity in pod virtual machines is also recommended. Additionally, organizations should consider the potential operational impact and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and tracking exceptions are also important aspects to consider in the remediation process. Security teams should work closely with operators and platform teams to ensure effective mitigation and to verify the effectiveness of the implemented controls. The vulnerability highlights the importance of rigorous vulnerability management and the need for continuous monitoring and review of system configurations and updates. By taking these steps, organizations can minimize the risk associated with this vulnerability and protect their sensitive workloads. It is also essential to leverage source-grounded technical framing and defensive impact assessments to inform remediation efforts and ensure that all necessary precautions are taken to prevent exploitation. Overall, a comprehensive approach to vulnerability management, including prompt patching, thorough review of system configurations, and continuous monitoring, is essential to mitigate the risks posed by this vulnerability. The CVE record and NVD detail provide critical information for understanding the vulnerability and developing effective mitigation strategies. By prioritizing remediation and taking a proactive approach to vulnerability management, organizations can reduce the likelihood of successful exploitation and protect their assets from potential harm. Conf

Technical summary

A crafted OCI image layer can make image_rs::stream::unpack::unpack() create a hardlink outside its destination directory in Confidential Containers Guest Components versions 0.16.0 to 0.20.0. This issue is fixed in version 0.20.0. The vulnerability allows a workload-owner escape into the pod virtual machine, potentially enabling access to pod virtual machine capabilities and attestation abuse. The issue arises from the try_hardlink_fallback() function in image-rs/src/stream/unpack.rs, which validates the hardlink source but computes the destination with destination.join(&entry_rel). Rust Path::join replaces the base when entry_rel is an absolute tar entry path, so fs::hard_link(&src_canon, &dst_entry_abs) can write attacker-controlled content to an arbitrary absolute path.

Defensive priority

Organizations using Confidential Containers Guest Components should prioritize updating to version 0.20.0 or later to address the hardlink vulnerability.

Recommended defensive actions

• Update Confidential Containers Guest Components to version 0.20.0 or later
• Review and validate image content before use
• Monitor for suspicious activity in pod virtual machines
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail provide information on the vulnerability in Confidential Containers Guest Components. The issue allows a crafted OCI image layer to create a hardlink outside its destination directory, potentially enabling workload-owner escape into the pod virtual machine.

Official resources