CVE-2026-107935

No fix known EPSS <1%CVSS 9.3

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

Published 2026-10-09 · CVE record · OSV

Products: Red Hat Build of Podman Desktop, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Edge Manager 1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenStack Platform 18.0

Distro releases