Security vulnerability CVE-2024-21626 was disclosed by the runc community. Attackers can exploit this vulnerability to gain unauthorized access to the host machine or execute binary programs. For details, refer to GHSA-xr7r-f8xq-vfvv.

Vulnerability level

The CVE-2024-21626 vulnerability has been assessed as a high risk vulnerability, with a CVSS score of 8.6.

Scope of impact

Affected runc versions: 1.0.0-rc93 <= runc <= 1.1.11

Secure runc version: runc 1.1.12

VKE cluster scope of impact: v1.4.11 <= node Containerd version <= v1.6.21-vke.11

Vulnerability impact

When the runc version in use falls within the affected range, internal file descriptor leaks may occur. An attacker can set the working directory of a newly created container process to the host file system namespace, which may result in container escape. For more details, please refer to Volcano Engine statement on the impact of the runc container escape vulnerability (CVE-2024-21626).

Preventive measures

Ensure that containers, including those started with runc exec, use only images whose process.cwd is / (the root directory).

Based on the principle of least privilege, ensure that only trusted personnel have permission to import images.

Ensure that users are only allowed to use images from trusted repositories.

Repair solution

Newly created VKE clusters are not affected by this vulnerability. For VKE cluster nodes within the affected scope, please upgrade the cluster to the latest patch version.

For users who are unable to use the cluster upgrade feature, please submit a ticket to obtain technical support. Upgrade the runc of the affected nodes to version 1.1.12.

Last updated: 2026.07.15 15:51:28

Public security network record in Beijing: No. 11010802032137