CVE-2026-46695Critical· 10.0▾ MidnightRead-only volume remount bypass via guest CAP_SYS_ADMIN
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.5%
Last analysed / modified upstream
Affected versions of boxlite mount host directories shared via virtiofs
as guest-side read-only by setting MS_RDONLY from the guest. Because the
default guest capability set included CAP_SYS_ADMIN, untrusted code
running inside a sandbox could execute mount -o remount,rw <path> to
re-flag the share as read-write and then write through to the host
filesystem — fully escaping the read-only contract boxlite advertised
to callers.
The fix in v0.9.0 enforces read-only at the hypervisor level via
krun_add_virtiofs3 (so the guest's MS_RDONLY is no longer the
authoritative gate) and drops CAP_SYS_ADMIN from the default guest
capability set (matching Docker's defaults).
This is a sandbox-escape bug: boxlite is a sandboxing runtime, so the
read-only invariant is part of its security contract. CVSS rated 10.0 by
the upstream advisory.
boxlite >= 0.0.0-0, < 0.9.0Upgrade to a patched release:
boxlite 0.9.0Connected by shared product, vendor, weakness, or advisory.