CVE-2026-48785: Apptainer Path Traversal Vulnerability

CVE-2026-48785 Overview

CVE-2026-48785 is a path traversal weakness [CWE-22] in Apptainer, an open source container platform used in high-performance computing environments. Versions prior to 1.5.1 apply plain string-prefix matching in the Image.AuthorizedPath function when enforcing the limit container paths directive in apptainer.conf. As a result, an allowlisted directory such as /data/safe also authorizes sibling paths such as /data/safe-but-unsafe. A local user can run a container from a directory outside the administrator's intended allowlist when Apptainer runs in setuid mode. The maintainers fixed the issue in version 1.5.1.

Critical Impact
Local users can bypass administrator-defined container path restrictions on setuid-enabled Apptainer installations, allowing execution of container images from unauthorized directories.

Affected Products

Apptainer versions prior to 1.5.1
Installations operating in setuid mode
Deployments that configure the limit container paths directive in apptainer.conf

Discovery Timeline

2026-09-15 - CVE-2026-48785 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-48785

Vulnerability Analysis

Apptainer administrators can restrict where users load container images from by setting the limit container paths directive in apptainer.conf. The enforcement logic lives in the Image.AuthorizedPath function within pkg/image/image.go. Prior to version 1.5.1, that function used the Go standard library strings package to test whether a requested path started with an allowed prefix. String-prefix comparison does not respect path component boundaries. An allowlist entry of /data/safe therefore matches any sibling path that begins with the same characters, such as /data/safe-but-unsafe or /data/safefoo. When Apptainer runs in setuid mode, the runtime executes with elevated privileges to set up namespaces and mounts, so bypassing the path allowlist expands the set of images a local user can launch under that privileged context.

Root Cause

The root cause is the use of string-prefix matching instead of path-component matching. The strings.HasPrefix style comparison treats file paths as opaque character sequences and ignores the / separator that delineates directory components. Any allowlisted directory name that is also a prefix of an adjacent directory name silently authorizes that adjacent directory.

Attack Vector

A local authenticated user identifies a directory that shares a string prefix with an entry in limit container paths. The user places a container image in that sibling directory and invokes Apptainer in setuid mode to run the image. The bypass requires local access and some user interaction with the runtime, and it depends on the specific administrator configuration. Installations that do not use setuid mode, or that do not configure limit container paths, are not affected. Environments that already permit unrestricted user namespaces are also unaffected because users can run arbitrary containers by design.

// Patch excerpt from pkg/image/image.go
// fix: limit container paths using path prefix, not string prefix
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 	"syscall"

 	"github.com/apptainer/apptainer/internal/pkg/util/fs"

Source: Apptainer commit 0ff35257. The patch removes the strings import and replaces string-prefix comparison with path-aware prefix logic that respects directory component boundaries.

Detection Methods for CVE-2026-48785

Indicators of Compromise

Apptainer invocations by local users referencing container image paths that resolve outside the directories explicitly listed in limit container paths.
Filesystem creation of directories whose names share a string prefix with an allowlisted directory, for example /data/safe-but-unsafe when /data/safe is allowed.
Setuid apptainer or starter-suid executions correlated with images stored in unexpected parent directories.

Detection Strategies

Audit apptainer.conf and enumerate every path listed under limit container paths, then search each parent directory for siblings that share the leading characters of an allowlisted entry.
Review shell history and process auditing (auditd, execve logs) for apptainer run, apptainer exec, and apptainer shell invocations against image paths that fall outside the intended allowlist.
Compare the installed Apptainer version against 1.5.1 across all HPC and shared Linux hosts to identify vulnerable deployments.

Monitoring Recommendations

Enable Linux audit rules on the apptainer and starter-suid binaries and forward events to a centralized log store for retention and query.
Track changes to apptainer.conf with file integrity monitoring so allowlist modifications are reviewed.
Alert on new directory creation events under filesystem roots that host allowlisted container paths.

How to Mitigate CVE-2026-48785

Immediate Actions Required

Upgrade Apptainer to version 1.5.1 or later on every host where the runtime is installed.
Inventory apptainer.conf on all systems and identify allowlist entries whose names could collide with sibling directories.
Rename or remove sibling directories that share a string prefix with entries in limit container paths until patching is complete.

Patch Information

The fix is available in Apptainer release v1.5.1. The code change is documented in pull request #3549 and commit 0ff35257. Additional detail is published in GitHub Security Advisory GHSA-cr2j-534f-mf3g.

Workarounds

Disable setuid mode by setting allow setuid = no in apptainer.conf where the operational model permits, since installations without setuid are not affected.
Remove the limit container paths directive and enforce container image location through filesystem permissions on the parent directories instead.
Choose allowlist entries whose full path component names cannot appear as a prefix of any sibling directory name.

bash

# Example: rewrite allowlist entries so no sibling can share the prefix
# Vulnerable configuration in apptainer.conf
# limit container paths = /data/safe

# Safer configuration: use a dedicated parent directory
# limit container paths = /data/containers/approved/

# Verify the installed version is patched
apptainer --version   # expect 1.5.1 or later