CVE-2026-46695: Boxlite Privilege Escalation Vulnerability

CVE-2026-46695 Overview

CVE-2026-46695 affects Boxlite, a sandbox service that creates lightweight virtual machines (Boxes) to launch Open Container Initiative (OCI) containers for running untrusted code. Versions prior to 0.9.0 fail to restrict the Linux kernel capabilities available inside the container. Malicious code running in the sandbox can remount directories in read-write mode and perform arbitrary writes against paths intended to be read-only. The flaw is tracked under [CWE-284: Improper Access Control] and is patched in version 0.9.0.

Critical Impact
Untrusted code executing in a Boxlite sandbox can bypass read-only filesystem protections, write to host-influenced directories, and undermine the integrity guarantees of the container isolation boundary.

Affected Products

Boxlite sandbox service versions prior to 0.9.0
OCI containers launched within Boxlite Boxes inheriting unrestricted capabilities
Workloads running untrusted code under affected Boxlite deployments

Discovery Timeline

2026-06-10 - CVE-2026-46695 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46695

Vulnerability Analysis

The vulnerability stems from Boxlite launching OCI containers with the default Linux kernel capability set rather than a restricted subset. Capabilities such as CAP_SYS_ADMIN permit a process inside the container to invoke mount(2) and mount(2) with MS_REMOUNT. An attacker controlling untrusted code inside a Box can therefore remount a directory that the sandbox intended to expose read-only, flipping the mount flags to read-write. Once remounted, the attacker can write, modify, or delete files in those paths. The issue undermines the integrity guarantees that downstream consumers expect from a sandbox marketed for executing untrusted code.

Root Cause

The root cause is missing capability restriction during container initialization. Boxlite did not drop privileged capabilities such as CAP_SYS_ADMIN before handing execution to the container payload. With these capabilities present, the kernel honors mount syscalls issued from inside the container, allowing the read-only enforcement applied at mount time to be reversed at runtime.

Attack Vector

Exploitation requires the ability to submit or execute code inside a Boxlite-managed Box, which is the service's intended workflow for untrusted workloads. The attacker invokes a mount remount operation against the target directory, then performs arbitrary write operations. No authentication to a separate management plane is required because the capability is granted to the workload itself. Refer to the GitHub Security Advisory GHSA-g6ww-w5j2-r7x3 and the upstream fix in pull request #454 for the technical remediation details.

Detection Methods for CVE-2026-46695

Indicators of Compromise

Unexpected mount or remount syscalls originating from inside Boxlite container workloads.
Modifications to files under directories that were provisioned as read-only by the sandbox configuration.
Container processes holding CAP_SYS_ADMIN despite policy expectations that capabilities be dropped.

Detection Strategies

Audit running Boxlite versions across hosts and flag any instance reporting a version earlier than 0.9.0.
Enable Linux audit rules for the mount syscall and correlate events to container PIDs and cgroups.
Compare runtime container capability sets against an allowlist and alert on any container retaining mount-related capabilities.

Monitoring Recommendations

Forward container runtime and kernel audit logs to a centralized analytics platform for syscall correlation.
Establish file integrity monitoring on directories the sandbox advertises as read-only to the workload.
Track outbound network behavior from sandboxed workloads to detect post-write persistence or staging activity.

How to Mitigate CVE-2026-46695

Immediate Actions Required

Upgrade all Boxlite deployments to version 0.9.0 or later, as published in the GitHub Release v0.9.0.
Inventory Boxlite hosts and confirm no workload is still launching containers under a vulnerable build.
Review historical sandbox activity for any evidence of mount remount operations prior to the upgrade.

Patch Information

The maintainers fixed the issue in Boxlite 0.9.0 by restricting the kernel capabilities granted to containers, preventing the remount primitive. The code change is documented in pull request #454 and the GitHub Security Advisory GHSA-g6ww-w5j2-r7x3.

Workarounds

If immediate upgrade is not possible, wrap Boxlite container launches with an external runtime configuration that explicitly drops CAP_SYS_ADMIN and other mount-related capabilities.
Apply a seccomp profile that blocks the mount and umount2 syscalls for sandboxed workloads.
Avoid mounting sensitive host directories into Boxlite sandboxes until the patched version is deployed.

bash

# Configuration example: drop mount-related capabilities and block mount syscalls
# Example shown for a generic OCI runtime; adapt to your Boxlite invocation.
--cap-drop=ALL \
--cap-add=CHOWN --cap-add=SETUID --cap-add=SETGID \
--security-opt seccomp=/etc/seccomp/no-mount.json \
--read-only