CVE-2026-47699: Confidential Containers Path Traversal

CVE-2026-47699 Overview

CVE-2026-47699 is a path traversal vulnerability [CWE-22] in Confidential Containers Guest Components, a project that provides guest tools for confidential container workloads. The flaw exists in the image_rs::stream::unpack::unpack() function used to unpack OCI image layers. A crafted OCI image layer can cause try_hardlink_fallback() in image-rs/src/stream/unpack.rs to create a hardlink outside the intended destination directory. The issue affects versions from 0.16.0 up to 0.20.0 and is fixed in version 0.20.0.

Critical Impact
A workload owner can write attacker-controlled content to arbitrary absolute paths inside the pod virtual machine, enabling escape into the pod VM and potential attestation abuse.

Affected Products

Confidential Containers Guest Components image-rs versions 0.16.0 through 0.19.x
Confidential container workloads consuming crafted OCI image layers
Pod virtual machines relying on image_rs::stream::unpack::unpack() for image extraction

Discovery Timeline

2026-08-18 - CVE-2026-47699 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-47699

Vulnerability Analysis

The vulnerability resides in the OCI image layer unpacking logic of image-rs. When processing a hardlink entry from a tar layer, try_hardlink_fallback() computes the destination path with destination.join(&entry_rel). Rust's Path::join method replaces the base path entirely when the joined path is absolute. An attacker who crafts a tar entry with an absolute path bypasses the destination directory constraint. The subsequent call to fs::hard_link(&src_canon, &dst_entry_abs) then materializes a hardlink at an attacker-chosen absolute path.

In the Confidential Containers threat model, the workload owner already controls trusted image content, so this does not cross the image trust boundary. The security impact is a workload-owner escape into the pod virtual machine. The escape may expose pod VM capabilities and enable abuse of the attestation flow.

Root Cause

The root cause is unsafe use of Path::join with untrusted tar entry paths. The function validates the hardlink source but fails to normalize or reject absolute destination paths from the tar archive. Rust's documented Path::join semantics discard the base path when the appended segment is absolute, making the join operation unsafe for path containment.

Attack Vector

An attacker with control over an OCI image layer supplies a tar hardlink entry containing an absolute path. When the guest components unpack the image inside the pod VM, the hardlink is placed at the attacker-specified location outside the extraction directory. This yields arbitrary file placement inside the pod virtual machine.

text

// Patch excerpt: image-rs/Cargo.toml — introduce pathrs
 ocicrypt-rs = { path = "../ocicrypt-rs", default-features = false, features = [
     "async-io",
 ], optional = true }
+pathrs = "0.2.4"
 protos = { path = "../protos", optional = true, default-features = false }
 reqwest = { workspace = true, features = ["json"], optional = true }
 resource_uri = { path = "../attestation-agent/deps/resource_uri", optional = true }

Source: GitHub Commit 14fbb711. The fix introduces the pathrs crate for safe path resolution to prevent traversal via absolute tar entries.

Detection Methods for CVE-2026-47699

Indicators of Compromise

Hardlinks in the pod virtual machine filesystem pointing to paths outside expected image extraction directories.
OCI image layers containing tar hardlink entries with absolute paths such as /etc/, /root/, or attestation-related files.
Unexpected modifications to attestation configuration or trust anchors following image pull operations.

Detection Strategies

Inspect OCI image layers before deployment for tar hardlink entries whose linkname or path components resolve to absolute paths.
Audit running image-rs versions across confidential container nodes and flag any version between 0.16.0 and 0.19.x.
Monitor image_rs::stream::unpack::unpack() execution paths in verbose logs for hardlink creations outside the target directory.

Monitoring Recommendations

Enable filesystem auditing inside pod VMs on sensitive paths including attestation binaries and configuration files.
Log and alert on hardlink syscalls originating from container image unpacking processes.
Track OCI image provenance and correlate anomalous filesystem writes with recent image pulls.

How to Mitigate CVE-2026-47699

Immediate Actions Required

Upgrade Confidential Containers Guest Components to version 0.20.0 or later, which incorporates the pathrs safe path resolution fix.
Restrict which workload owners can supply OCI images to confidential container environments until patched.
Review pod VM filesystem integrity on nodes that ran affected image-rs versions.

Patch Information

The fix is available in GitHub Release v0.20.0. The remediation is tracked in GitHub Pull Request #1440 and GitHub Pull Request #1457, with details in GitHub Security Advisory GHSA-84rc-2q4r-45pc.

Workarounds

Pre-scan OCI image layers and reject any tar entries containing absolute paths in the linkname or path fields.
Enforce policies that only allow signed images from trusted publishers into confidential container workloads.
Where upgrade is not immediately possible, isolate confidential workloads on dedicated nodes to limit blast radius.

bash

# Verify installed image-rs version and upgrade guest-components
git clone https://github.com/confidential-containers/guest-components.git
cd guest-components
git checkout v0.20.0
cargo build --release -p image-rs