Loading vulnerability…
CVE-2026-46680 is an input-handling flaw in containerd affecting versions before 1.7.32, 2.0.9, 2.2.4, and 2.3.1. A container image USER directive containing a numeric value that cannot be parsed as a 32-bit integer is incorrectly interpreted as a username. An attacker-controlled image can map that oversized numeric string to the root account in its passwd database, causing a workload subject to Kubernetes runAsNonRoot restrictions to execute as UID 0.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a minimal proof-of-concept for CVE-2026-46680 centered on container/Kubernetes security policy bypass behavior rather than a traditional remote exploit. It contains only three files: a Dockerfile that builds the crafted image, a pod.yaml manifest that deploys it into Kubernetes, and a short README naming the CVE. The Dockerfile uses alpine:latest, appends a forged entry to /etc/passwd for UID 4294967296, sets USER 4294967296, and launches a shell command that runs id and then sleeps. The pod manifest sets securityContext.runAsNonRoot: true and deploys the crafted image, indicating the intended demonstration is that a pod configured as non-root may still start and behave as root or bypass non-root enforcement under vulnerable conditions. There are no external network callbacks, C2 endpoints, or exploit delivery routines; the main capability is local/container privilege-policy bypass demonstration in a Kubernetes context. The repository is therefore a simple POC exploit for validating or reproducing the issue, not a weaponized framework or detection-only script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity containerd flaw allowing a crafted container image to evade Kubernetes runAsNonRoot restrictions and execute as root when a malformed large numeric User directive is mapped to UID 0 in the image's /etc/passwd file.
A locally exploitable vulnerability requiring user interaction, with high impact on confidentiality, integrity, and availability according to the supplied CVSS v3 and v4 vectors.
A Unity Linux vulnerability addressed by advisory UTSA-2026-107041. It is assessed as a local vulnerability requiring user interaction, with high impact to confidentiality, integrity, and availability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.