PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top 9 Docker Container Security Vulnerabilities

aikido.dev | blog | #container-security | #privilege-escalation | #cve | #docker | #container-escape | #vulnerabilities | #hardcoded-secrets | #misconfiguration | #runc | #misconfigurations | #privileges
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Every FROM instruction and installed package in an image is a potential attack vector. The list spans nine Docker vulnerabilities, from runC breakouts to hardcoded secrets and excessive privileges.
Published
Collected

Related coverage

blog · wiz.io
Docker and Kubernetes, we have got you covered: Wiz simplifies compliance and security posture management for Docker and Kubernetes environments.
Wiz extends its CIS SecureSuite Vendor Certification to CIS Kubernetes v1.7 and Docker 1.6 benchmarks (Levels 1 and 2), bringing 100+ controls for compliance and secure configuration.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · calif.io
Privilege escalation in AWS Elastic Kubernetes Service
# Privilege escalation in AWS Elastic Kubernetes Service How a pod with the wrong permissions becomes control of the whole cluster. An Trinh and Duc Nguyen April 2, 2023 cloud Update · August 19,...
blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
blog · aikido.dev
Your CVE is reachable. But is it exploitable?
Any SCA tool worth its salt has reachability analysis these days. When a dependency has a known vulnerability, these tools can tell you whether your code calls the affected function. This is pretty much non-negotiable because it helps teams focus their security efforts instead of sifting through noise. Every other step in prioritizing dependency CVEs builds on it.
blog · aikido.dev
When read-only mounts in Docker Sandboxes become writable
This coverage gives security teams current context for monitoring, validation, and remediation.
Back