CVE-2021-30465: runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal.

Security readout for executives and security teams

This flaw affects runc, a low-level container runtime. In vulnerable versions before 1.0.0-rc95, a container setup using specific mounts could let an attacker break out of the intended container filesystem boundary. Exploitation requires the attacker to create multiple containers with a particular configuration, so exposure depends heavily on who can create containers and mounts. Most relevant exposure is in container platforms using runc before 1.0.0-rc95, especially where tenants, CI jobs, or users can create containers with custom mount settings. Systems using vendor backports may be fixed without showing the upstream version number. Prioritize remediation on shared container infrastructure, CI runners, and any environment where untrusted users can launch containers. The business risk is highest where a container boundary failure could expose host files or cross-tenant data. Mitigation focus: Upgrade runc to 1.0.0-rc95 or a later fixed release.; Apply distribution or vendor security updates for runc packages.; Confirm whether vendor packages include a backported fix..

Prepared

Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.