{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-113951",
        "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "state": "PUBLISHED",
        "assignerShortName": "apple",
        "dateReserved": "2026-10-20T21:06:55.479Z",
        "datePublished": "2026-10-23T20:57:20.150Z",
        "dateUpdated": "2026-10-23T20:57:20.150Z"
    },
    "containers": {
        "cna": {
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Apple",
                    "product": "Container",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThan": "1.5.0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0."
                }
            ],
            "references": [
                {
                    "url": "https://github.com/apple/container/security/advisories/GHSA-44v5-vx46-ghv6"
                }
            ],
            "providerMetadata": {
                "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
                "shortName": "apple",
                "dateUpdated": "2026-10-23T20:57:20.150Z"
            }
        }
    }
}