Leaky Vessels: runc Container Escape (CVE-2024-21626)

What to do

1. Check your runc version with `runc --version` (and `docker info` or `containerd --version` on managed nodes) and upgrade to runc 1.1.12 or later.
2. Update Docker Engine to 25.0.2 / 24.0.9 or later and BuildKit to 0.12.5 or later.
3. Patch Kubernetes node images through your provider or distro; managed nodes often bundle runc.
4. Until patched, run only trusted images and keep process.cwd and --cwd set to /.
5. Prioritize CI runners and shared build infrastructure that build or run third-party Dockerfiles.

How to check if you are affected or compromised

• Search images and Dockerfiles for WORKDIR or symlinks referencing /proc/self/fd/.
• Look for container specs or `runc exec --cwd` values resolving through /proc/self/fd/<n>.
• Run Snyk's open-source leaky-vessels static or runtime detectors as a hunting aid.
• Check host binaries (for example with your package manager's verify mode) for unexpected modification.

What happened#

On January 31, 2024, the runc maintainers published GHSA-xr7r-f8xq-vfvv (CVE-2024-21626). runc, the low-level runtime underneath Docker, containerd and most Kubernetes nodes, leaked internal file descriptors into the container's init process, including a handle to the host's /sys/fs/cgroup. It also did not check that the working directory was still inside the container after chdir. Together, that let a container process get a working directory on the host filesystem.

The advisory describes four attacks:

• Attack 1 (runc run): a malicious image sets its working directory to something like /proc/self/fd/7/, landing the process in the host's mount namespace.
• Attack 2 (runc exec): a process already in a container swaps a path used by runc exec --cwd for a symlink to the leaked fd.
• Attacks 3a and 3b: variants that overwrite host binaries, which gives a full escape.

Rory McNamara of Snyk found the original issue and named the set "Leaky Vessels", together with three BuildKit bugs disclosed the same day: CVE-2024-23651 (mount cache race), CVE-2024-23652 (arbitrary delete on build-container teardown) and CVE-2024-23653 (gRPC SecurityMode privilege check). Other variants were credited to lifubang and Aleksa Sarai.

Who is affected#

runc v1.0.0-rc93 through 1.1.11. The fix is runc 1.1.12. Snyk lists the downstream fixes as BuildKit 0.12.5 and Moby (Docker Engine) 25.0.2 and 24.0.9, with containerd 1.6.28 also released. NVD rates CVE-2024-21626 at 8.6 (local attack vector, user interaction required). The advisory notes crun and youki do not currently leak useful fds, though they lack runc's new hardening.

Do you really need to act?#

Yes, but the urgency depends on who controls your images. Every attack requires either running an attacker-built image or Dockerfile, or an attacker already inside a container plus someone running runc exec into it. That makes the highest-risk environments:

• CI/CD runners and build services that build arbitrary Dockerfiles from pull requests or customers.
• Multi-tenant Kubernetes clusters and platforms that run user-supplied images.
• Developer machines that pull and run untrusted images.

On a single-tenant host running only your own pinned images, an attacker first needs to compromise your supply chain. Snyk reported finding no evidence of exploitation in its non-exhaustive checks of public Dockerfiles. CVE-2024-21626 is not in the CISA KEV catalog as of October 21, 2026. Still, container escapes break the main promise of containers, and runc is everywhere, so patch within days, not months.

What to do now#

1. Run runc --version on hosts (and check docker version for the Engine) and upgrade to runc 1.1.12 or later.
2. Update Docker Engine to 25.0.2 / 24.0.9 or later and BuildKit to 0.12.5 or later.
3. Roll Kubernetes node pools to patched images from your provider or distro.
4. Until patched, run only trusted images and keep process.cwd and --cwd at /, the advisory's workaround for attacks 1 and 2. Attack 3b has no practical workaround besides avoiding runc exec.
5. Patch shared build infrastructure first.

How to tell if you were hit#

The advisory publishes no formal indicators. Practical hunting: search Dockerfiles and image layers for a WORKDIR, working directory or symlink pointing into /proc/self/fd/, and executable paths that traverse out of it (for example /proc/self/fd/7/../../../bin/bash). Snyk released open-source static and eBPF runtime detectors (leaky-vessels-static-detector and leaky-vessels-runtime-detector) as hunting aids; each hit needs manual review. Verify host binaries against your package manager if you suspect attack 3.

Timeline#

• Jan 31, 2024 — runc 1.1.12, BuildKit 0.12.5 and Docker Engine 25.0.2 / 24.0.9 released; advisories published.
• Oct 21, 2026 — No in-the-wild exploitation confirmed in the sources reviewed; not in KEV; brief updated.

Vulnerability records

• CVE-2024-21626 · runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.
• CVE-2024-23651 · BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
• CVE-2024-23652 · BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
• CVE-2024-23653 · BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. runc — GHSA-xr7r-f8xq-vfvv: Several container breakouts due to internally leaked fds github.com
2. NVD — CVE-2024-21626 nvd.nist.gov
3. Snyk Labs — Leaky Vessels: Docker and runc container breakout vulnerabilities labs.snyk.io
4. CISA — Known Exploited Vulnerabilities Catalog cisa.gov