{"id":"CVE-2026-113951","kind":"vulnerability","aliases":["CVE-2026-113951"],"related":[],"title":"Container k8s: planted kubeconfig exec plugin runs commands on macOS host","description":"If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.","summary":"Container, Apple's tool for running Linux containers on macOS, lets an attacker who can write to a k8s cluster container's filesystem plant an exec credential plugin in /etc/kubernetes/admin.conf. When a user later pulls that kubeconfig to the host with container k8s write-config or create and runs kubectl, the plugin executes as the macOS host user, giving the attacker arbitrary command execution on the host.","severity":"high","cvss":null,"epss":0.00224,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["container","developer-workstations","kubectl","kubernetes","macos","other"],"not_affected_if":["not-using-container-k8s","trusted-containers-only"],"how_to_check":"- Check the installed Container version with `container --version` and compare it against `1.5.0`.\n- Look for `container k8s` usage on the host, and check whether kubeconfig files written by `container k8s write-config` contain an `exec:` credential plugin block.","fix":"- Upgrade Apple Container to `1.5.0` or later.\n- Inspect any kubeconfig pulled from a cluster container for unexpected `exec:` entries before running kubectl against it.","status":"open","published_at":"2026-10-23T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:52:06+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:52:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apple Container to `1.5.0` or later.\n- Inspect any kubeconfig pulled from a cluster container for unexpected `exec:` entries before running kubectl against it.","reach":"local","title":"Container k8s: planted kubeconfig exec plugin runs commands on macOS host","impact":"high","summary":"Container, Apple's tool for running Linux containers on macOS, lets an attacker who can write to a k8s cluster container's filesystem plant an exec credential plugin in /etc/kubernetes/admin.conf. When a user later pulls that kubeconfig to the host with container k8s write-config or create and runs kubectl, the plugin executes as the macOS host user, giving the attacker arbitrary command execution on the host.","category":"other","nicknames":[],"who_cares":["macos","container","kubernetes","kubectl","developer-workstations"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as the macOS host user","analyst_note":"Confirm the affected version range and the exact container k8s commands from the NVD entry or upstream Container advisory; sources gave no CVSS score.","how_to_check":"- Check the installed Container version with `container --version` and compare it against `1.5.0`.\n- Look for `container k8s` usage on the host, and check whether kubeconfig files written by `container k8s write-config` contain an `exec:` credential plugin block.","needs_analyst":true,"not_affected_if":["not-using-container-k8s","trusted-containers-only"],"who_is_affected":"Developers and teams on macOS who run Container with its Kubernetes support (container k8s) and pull kubeconfig from cluster containers onto the host. Exposure requires a container in the cluster that an attacker can write to, so teams that do not use container k8s or run only trusted containers face lower risk.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":3372,"output_tokens":677,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113951':14A,17A '-2026':13A,16A '/etc/kubernetes/admin.conf':54B,115C '1.5.0':174C 'access':154C 'address':170C 'appl':26B 'arbitrari':87B,161C 'attack':37B,86B,95C 'cluster':44B,105C,132C 'command':8A,88B,162C 'config':70B,143C 'contain':1A,18B,25B,32B,45B,66B,103C,106C,139C,159C,172C 'creat':72B,145C 'credenti':51B,112C 'cve':12A,15A 'develop':20B 'developer-workst':19B 'exec':5A,50B,111C 'execut':78B,89B,163C 'filesystem':47B,100C,153C 'give':84B 'host':11A,64B,82B,92B,124C,137C,166C 'insid':155C 'k8s':2A,43B,67B,104C,140C 'kubeconfig':4A,61B,134C 'kubectl':22B,75B,116C,149C 'kubernet':23B 'later':58B 'let':35B 'linux':31B,158C 'maco':10A,24B,34B,81B,123C 'next':127C 'onto':135C 'plant':3A,48B,109C 'plugin':6A,52B,77B,113C,120C 'pull':59B,130C 'run':7A,30B,74B,118C,148C 'someon':129C 'time':128C 'tool':28B 'turn':152C 'untrust':157C 'user':57B,83B,125C 'version':173C 'vulner':168C 'workstat':21B 'write':40B,69B,97C,142C 'write-config':68B,141C","nicknames":[],"mitigations":[],"who_affected":"Developers and teams on macOS who run Container with its Kubernetes support (container k8s) and pull kubeconfig from cluster containers onto the host. Exposure requires a container in the cluster that an attacker can write to, so teams that do not use container k8s or run only trusted containers face lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T21:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113951","severity":null,"published_at":"2026-10-23T21:17:21+00:00","modified_at":"2026-10-23T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113951","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113951","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}