Vulnerability Details CVE-2026-64777
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.2%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-64777
-
cpe:2.3:a:apple:container:0.1.0
-
cpe:2.3:a:apple:container:0.10.0
-
cpe:2.3:a:apple:container:0.11.0
-
cpe:2.3:a:apple:container:0.12.0
-
cpe:2.3:a:apple:container:0.12.1
-
cpe:2.3:a:apple:container:0.12.2
-
cpe:2.3:a:apple:container:0.12.3
-
cpe:2.3:a:apple:container:0.2.0
-
cpe:2.3:a:apple:container:0.3.0
-
cpe:2.3:a:apple:container:0.4.0
-
cpe:2.3:a:apple:container:0.4.1
-
cpe:2.3:a:apple:container:0.5.0
-
cpe:2.3:a:apple:container:0.6.0
-
cpe:2.3:a:apple:container:0.7.0
-
cpe:2.3:a:apple:container:0.7.1
-
cpe:2.3:a:apple:container:0.8.0
-
cpe:2.3:a:apple:container:0.9.0
-
cpe:2.3:a:apple:container:1.0.0
-
cpe:2.3:a:apple:container:1.1.0