Executive brief
A vulnerability in systemd-nspawn, a tool used to run lightweight containers on Linux, could allow a container to break out and access the host operating system. This occurs when the tool processes specially crafted configuration files, potentially leading to a full system compromise. An attacker would need high-level privileges to place these malicious configuration files in specific system directories to trigger the flaw.
Technical details
A container escape vulnerability exists in systemd-nspawn due to parsing bugs in the handling of PivotRoot=, BindUser=, and Ephemeral= options within .nspawn configuration files. When these crafted configuration files are placed in directories where they are automatically picked up (requiring high privileges), the container may be spawned on the host rootfs instead of the intended container image. This allows an attacker with the ability to influence these configuration files to achieve a container breakout. The issue is addressed in systemd versions 260, 259.4, 258.6, and 257.12.
Affected products
- systemd project systemd-nspawn 233 to 259 (before 260)
Timeline
- 2026-03-12: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed: CVE published to NVD
- 2026-04-10: patched: Patched versions released (260, 259.4, 258.6, 257.12)