# CVE-2026-41579: opencontainers runc symlink following in rootfs setup

Source: https://junglewise.ai/threats/cve-2026-41579-opencontainers-runc-symlink-following-in-rootfs-setup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-41579 · Severity: low · CVSS 3.3 · Published 2026-07-01

runc, a widely used tool for managing Linux containers, contains a flaw in how it handles container images. A malicious image could trick the system into deleting specific files or creating unauthorized links on the host computer's file system. While the practical impact is limited because only specific filenames are affected, it could potentially lead to minor system instability or configuration errors. Users of Podman and containerd are primarily affected, while Docker users are protected by default security layers.

Technologies: [github.com/opencontainers/runc (Go)](https://junglewise.ai/threats/technologies/github-com-opencontainers-runc), [Open Container Initiative Runc](https://junglewise.ai/threats/technologies/runc). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Open Container Initiative](https://junglewise.ai/threats/vendors/open-container-initiative).

## Quick answers

**Is CVE-2026-41579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41579 being exploited in the wild.

**How severe is CVE-2026-41579?** Low severity, with a CVSS score of 3.3, published 1 July 2026.

**Which products and versions are affected?** github.com/opencontainers/runc (Go) SEMVER:introduced=0,fixed=1.3.6, SEMVER:introduced=0,fixed=1.3.6,introduced=1.4.0,fixed=1.4.3,introduced=1.5.0-rc.1,fixed=1.5.0-rc.3; Open Container Initiative Runc < 1.3.6, >= 1.4.0-rc.1 < 1.4.3, >= 1.5.0-rc.1 < 1.5.0-rc.3, <= 1.3.5, >= 1.4.0 <= 1.4.2, >= 1.5.0-rc.1 <= 1.5.0-rc.2.

**Is there a fix for CVE-2026-41579?** Yes. github.com/opencontainers/runc (Go): upgrade to 1.3.6, 1.5.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41579 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-41579?** Check whether you run github.com/opencontainers/runc (Go) or Open Container Initiative Runc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/opencontainers/runc (Go): upgrade to 1.3.6, 1.5.0-rc.3 or later

  ```sh
  go get github.com/opencontainers/runc@v1.5.0-rc.3
  ```


## Technical details

A symlink following vulnerability exists in runc's setupPtmx and setupDevSymlinks functions. When setting up a container rootfs, these functions use filepath.Join on paths that may be influenced by a malicious /dev symlink in the container image. Because these operations occur before pivot_root(2), an attacker can trick runc into calling os.Remove or os.Symlink on host paths. This allows for the deletion of host files named 'ptmx' or the creation of a hardcoded set of symlinks (e.g., stdin, stdout, core) in arbitrary host directories. The vulnerability is mitigated in Docker due to its read-only layer masking, but affects other runtimes like Podman and containerd. Fixes are available in versions 1.3.6, 1.4.3, and 1.5.0-rc.3.

## Affected products

- opencontainers runc < 1.3.6, >= 1.4.0-rc.1 < 1.4.3, >= 1.5.0-rc.1 < 1.5.0-rc.3

## Identifiers

- CVE-2026-41579
- GHSA-xjvp-4fhw-gc47
- GO-2026-5761

## Timeline

- 2026-06-12: patched: Fix committed to repository
- 2026-06-13: advisory: GitHub Advisory GHSA-xjvp-4fhw-gc47 published
- 2026-07-01: disclosed: NVD publication date

## References

- [https://github.com/opencontainers/runc/commit/864db8042dbb](https://github.com/opencontainers/runc/commit/864db8042dbb)
- [https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47](https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47)

## Related threats

- [runc container escape with malicious config due to /dev/console mount and related races](https://junglewise.ai/threats/cve-2025-52565-runc-container-escape-with-malicious-config-due-to-dev-console)
- [runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects](https://junglewise.ai/threats/cve-2025-52881-runc-container-escape-and-denial-of-service-due-to-arbitrary)
- [GO-2025-4096 - Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc](https://junglewise.ai/threats/cve-2025-31133-runc-multiple-container-escape-and-isolation-vulnerabilities)
- [Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66](https://junglewise.ai/threats/cve-2025-27612-go-2025-3543-withdrawn-libcontainer-is-affected-by-capabilities)
- [GO-2024-3110 - Can be confused to create empty files/directories on the host in github.com/opencontainers/runc](https://junglewise.ai/threats/cve-2024-45310-runc-can-be-confused-to-create-empty-files-directories-on-the)