CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

GHSA-C3G4-W6CV-6V7H

Inheritance Tax: Resurrecting Privileges in Docker & Buildah (CVE-2022-27651)

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·28 visits

Executive Summary (TL;DR)

Docker and Buildah accidentally left the 'Inheritable' capability set wide open. By default, containers should start with this set empty. Because it wasn't, a process inside a container could elevate its privileges back up to the Bounding Set limits simply by executing a binary with specific file capabilities attached, effectively bypassing security profiles that rely on dropping capabilities from the Effective set.

A logic flaw in Buildah and Moby (Docker Engine) allowed containers to start with a non-empty Inheritable capability set. This subtle misconfiguration permits attackers to 'resurrect' privileges that were intended to be restricted, bypassing container hardening measures by leveraging file capabilities.

Official Patches

BuildahGitHub Security Advisory with patch details
DockerDocker Engine 20.10.14 Release Notes

Fix Analysis (1)

Technical Appendix

CVSS Score
6.6/ 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

Buildah <= 1.24.0Moby (Docker Engine) < 20.10.14Fedora 34 (containers-common)Fedora 35 (containers-common)Fedora 36 (containers-common)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Buildah
Containers Project
<= 1.24.01.25.0
Moby (Docker)
Moby Project
< 20.10.1420.10.14
AttributeDetail
CWE IDCWE-276 (Incorrect Default Permissions)
CVSS v3.16.6 (Medium)
Attack VectorLocal (Container Internal)
Privileges RequiredLow
User InteractionNone
ScopeUnchanged

MITRE ATT&CK Mapping

T1548.001Abuse Elevation Control Mechanism: Setuid and Setgid
Privilege Escalation
T1611Escape to Host (Attempt)
Privilege Escalation
CWE-276
Incorrect Default Permissions

The application creates a process with an inheritable capability set that is not properly restricted, allowing child processes to acquire privileges intended to be dropped.

Known Exploits & Detection

Manual VerificationUse `grep CapInh /proc/self/status` inside a container. Non-zero values indicate vulnerability.

Vulnerability Timeline

CVE Published
2022-03-24
Docker 20.10.14 Released with Fix
2022-03-24
Buildah 1.25.0 Released with Fix
2022-03-24

References & Sources

  • [1]NVD - CVE-2022-27651
  • [2]Buildah Fix Commit
Related Vulnerabilities
CVE-2022-27651

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•2 minutes ago•CVE-2026-63376
8.2

CVE-2026-63376: Prototype Pollution via Path Desynchronization in toml-node

A prototype pollution vulnerability exists in the toml-node library (by BinaryMuse) in versions prior to 4.1.2. The flaw arises from inconsistent internal tracking of parsed paths (comma-joined vs. dot-joined serialization) combined with lack of object ownership validation during recursive dictionary descent (scalar descent). This allows unauthenticated remote attackers to modify base object structures by crafting malicious TOML documents containing conflicting duplicate table paths or nested references.

Alon Barad
Alon Barad
0 views•6 min read
•about 1 hour ago•CVE-2026-69083
10.0

CVE-2026-69083: Unauthenticated SQL Injection and SQL Command Execution in SiYuan Full-Text Search API

An unauthenticated SQL injection and SQL execution vulnerability in SiYuan allows remote attackers to compromise the integrity and confidentiality of the asset database. The flaw exists due to string concatenation in regular expression searches and a complete lack of authorization checks on raw SQL querying pathways under default configurations. Attackers can leverage this vulnerability to exfiltrate database contents, manipulate index records, or access cross-notebook contents without any valid credentials.

Alon Barad
Alon Barad
2 views•6 min read
•about 2 hours ago•CVE-2026-68587
9.2

CVE-2026-68587: Broken Access Control in SiYuan Note Transaction Endpoints

CVE-2026-68587 is a critical authorization bypass vulnerability in SiYuan, an open-source personal knowledge management workspace. When deployed in publish mode, specific transaction endpoints fail to perform administrative role validation. This omission enables unauthenticated remote readers to retrieve the rendered Document Object Model (DOM) of publish-disabled (private) documents by supplying a target heading block identifier. Upgrading to version v3.7.3 or later resolves this issue by applying appropriate routing middleware constraints.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 3 hours ago•CVE-2026-68586
9.2

CVE-2026-68586: Missing Authorization in SiYuan Backlink Content Endpoints Allows Information Disclosure

SiYuan is a privacy-first personal knowledge management system. In versions prior to v3.7.3, the application fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints correctly filter out publish-forbidden documents, the content endpoints, which are only gated by high-level route authorization checks via CheckAuth, do not. Consequently, a user with low-privilege read access, or an anonymous reader when publish Basic Auth is disabled, can directly invoke these endpoints using a known publish-forbidden document's ID to retrieve its rendered DOM content or determine whether it references a specific target block.

Amit Schendel
Amit Schendel
3 views•7 min read
•about 4 hours ago•CVE-2026-68585
5.8

CVE-2026-68585: Metadata Disclosure via Missing Authorization in SiYuan API

A metadata disclosure vulnerability exists in SiYuan prior to version v3.7.3. The /api/block/getBlockInfo endpoint fails to validate authorization boundaries in publish mode, allowing anonymous readers to access private document metadata.

Alon Barad
Alon Barad
6 views•8 min read
•about 5 hours ago•CVE-2026-72812
6.5

CVE-2026-72812: Broken Access Control and SQL Injection in SiYuan

A critical authorization bypass vulnerability exists in SiYuan personal knowledge management system before v3.7.4. The /api/ref/refreshBacklink endpoint lacks administrative role verification, enabling unauthenticated users to initiate database transactions and disk operations. When combined with an unsafe SQL generation pattern in nested backlink queries, an attacker can exploit a secondary SQL injection vulnerability to compromise local databases or cause denial-of-service conditions.

Amit Schendel
Amit Schendel
4 views•6 min read