Security vulnerabilities and automated fixes for container security issues
4 posts found
The `opensearch` service defined in `Docker/LocalCluster.s3.yaml` was running with a fully writable root filesystem, giving any process inside the container the ability to modify binaries, drop payloads, or persist malicious changes. The fix pins the container to a read-only root filesystem with `read_only: true`, closing off a common post-compromise persistence and tampering vector while preserving normal OpenSearch operation.
A critical vulnerability in containerd v1.7.32 allowed attackers to execute arbitrary commands as root on the host by manipulating image configuration labels processed by the CRI plugin. Upgrading to containerd v1.7.33 eliminates this attack vector through improved input validation.
CVE-2026-26217 is a critical Local File Inclusion (LFI) vulnerability in Crawl4AI versions prior to 0.8.0, where the Docker API fails to restrict `file://` URL schemes, allowing attackers to read arbitrary files from the host filesystem. The fix upgrades `crawl4ai` from `0.7.6` to `0.8.0` in `pyproject.toml` and `uv.lock`, closing a direct path to sensitive file exfiltration in any containerized deployment using this library.
A high-severity privilege escalation vulnerability was discovered in a Docker Compose configuration where the `nginx` service lacked the `no-new-privileges` security option and was running with a writable root filesystem. These misconfigurations could allow a compromised container process to gain elevated permissions or download and execute malicious payloads. The fix applies defense-in-depth by adding `no-new-privileges:true`, enforcing a read-only root filesystem, and redirecting writable path