CVE-2025-65105Apptainer is an open source container platform.
Updated under an hour ago ()
Does this affect you?
It affects lfprojects apptainer. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
- CVSS
- 5.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-61, CWE-706
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
lfprojects apptainer lfprojects:apptainer | before 1.4.5 | NVD |
References
- https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981patch
- https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2patch
- https://github.com/apptainer/apptainer/pull/3226issue-tracking
- https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46jpatch, vendor-advisory
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prmnot-applicable
- https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87not-applicable
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.