# CVE-2026-113951: Apple Container arbitrary command execution via Kubernetes plugin

Source: https://junglewise.ai/threats/cve-2026-113951-if-an-attacker-can-write-to-the-filesystem-of-a-container-k8s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-113951 · Severity: info · Published 2026-10-23

Apple's Container tool for managing Kubernetes clusters on macOS can be tricked into running malicious commands on the host machine. If an attacker gains write access to the Linux container filesystem, they can plant a malicious script that gets executed with the user's privileges when the cluster configuration is pulled to the host machine, leading to complete host compromise.

Technologies: [Apple Container](https://junglewise.ai/threats/technologies/container). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2026-113951 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113951 being exploited in the wild.

**How severe is CVE-2026-113951?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Apple Container before 1.5.0.

**Is there a fix for CVE-2026-113951?** Yes: fixed in 1.5.0. Until then: Do not run write-config against a container Kubernetes cluster whose filesystem you do not fully trust, and avoid container k8s create --node-image with node images from untrusted sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113951 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-113951?** Check whether you run Apple Container at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.5.0

Do not run write-config against a container Kubernetes cluster whose filesystem you do not fully trust, and avoid container k8s create --node-image with node images from untrusted sources.

## Technical details

The vulnerability exists in K8sHelper.transformConfig, which merges the Kubernetes admin.conf configuration from an untrusted container into the host's kubeconfig without filtering security-sensitive fields like users[].user.exec. An attacker with filesystem write access to the cluster container can plant an exec credential plugin in /etc/kubernetes/admin.conf; kubectl will execute this plugin on the host with the user's privileges when write-config or create --node-image operations are performed. The fix implements an allowlist approach, accepting only certificate and token-based credentials while rejecting exec and auth-provider entries.

## Affected products

- Apple Container before 1.5.0

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Version 1.5.0 released
- 2026-10-23: advisory

## References

- [https://github.com/apple/container/security/advisories/GHSA-44v5-vx46-ghv6](https://github.com/apple/container/security/advisories/GHSA-44v5-vx46-ghv6)

## Related threats

- [Apple Container digest verification bypass in image pull](https://junglewise.ai/threats/cve-2026-113957-an-attacker-who-controls-the-registry-a-mirror-or-the-network)
- [Apple container TCP port forwarder memory exhaustion](https://junglewise.ai/threats/cve-2026-64773-apple-container-tcp-port-forwarder-memory-exhaustion)
- [Apple container build filesystem symlink escape](https://junglewise.ai/threats/cve-2026-64777-apple-container-build-filesystem-symlink-escape)
- [Apple container pf rule injection in container system dns create](https://junglewise.ai/threats/apple-container-pf-rule-injection-in-container-system-dns-create-9afe0647)
- [Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry…](https://junglewise.ai/threats/cve-2026-28909-users-who-connect-to-malicious-registries-with-hostnames-matching)