r0binak

Classification basis

The Dockerfile is a complete, self-contained artifact that, when built and run on a vulnerable containerd instance, exercises the CVE-2026-46680 vulnerability to achieve privilege escalation. It actively constructs the conditions for the vulnerability (crafted /etc/passwd) and triggers the flawed USER parsing to run as root, which is the definition of exploit code.

Requirements

• A vulnerable version of containerd (prior to 1.7.32, 2.0.9, 2.2.4, 2.3.1) must be used to run the container.Dockerfile:1-4
• The container must be launched with a runAsNonRoot restriction (e.g., in Kubernetes) that the exploit is intended to bypass.Dockerfile:1-4

Observed behavior

• The Dockerfile adds an /etc/passwd entry mapping UID 4294967296 to username 'x' with UID 0 (root).Dockerfile:2
• The Dockerfile sets the USER directive to 4294967296, a number that cannot be parsed as a 32-bit integer, causing containerd to treat it as a username.Dockerfile:3
• The container's CMD runs 'id' to demonstrate the effective UID, which would be 0 if the exploit succeeds.Dockerfile:4

Observables

Vulnerability Demonstration

Payload withheldDemonstrates the CVE-2026-46680 runAsNonRoot evasion by mapping a large numeric string to root (UID 0).Dockerfile:2-3

Classification basis

The artifact is a README file containing a vulnerability description and a textual proof-of-concept scenario. It does not include any executable code, scanner, or exploit. The content is purely descriptive, fitting the definition of a writeup.

Requirements

• Headlamp version <= v0.38.0 installed with config.enableHelm: trueREADME.md:2README.md:6-7
• An authorized user must have previously accessed the Helm page to cache credentialsREADME.md:8

Observed behavior

• An unauthorized user can send a request to /clusters/main/helm/releases/list and receive a cached response containing sensitive information (keys, tokens, passwords)README.md:9

Observables

Documentation

Payload withheldThe file is a standard vulnerability disclosure document with no executable instructions or hidden payloads.README.md:1-10

Classification basis

The artifact contains complete, functional code that actively exploits the vulnerability to escape the container network namespace and establish a reverse shell. The README explicitly describes it as a 'Fully Weaponized NVIDIA Container Toolkit Exploit'.

Requirements

• The attacker must be able to run a container with the NVIDIA Container Toolkit hooks enabled and set the LD_PRELOAD environment variable to point to the malicious shared library.Dockerfile:10
• The malicious shared library (evil.so) must be present in the container's working directory.Dockerfile:9

Observed behavior

• Builds a Go shared library (evil.so) with a constructor function that executes automatically when loaded.Dockerfile:1-6evil.go:3-5
• The constructor function switches the process's network namespace to that of PID 1 (the host) using setns.evil.go:19-34
• After escaping the container's network namespace, the exploit removes the LD_PRELOAD variable and deletes the evil.so file to clean up.evil.go:39-40
• The exploit connects back to a configurable IP address and port (defaulting to payload withheld) and spawns a /bin/sh reverse shell, redirecting stdin, stdout, and stderr to the connection.evil.go:42-59

Observables

Reverse Shell

Payload withheldThe exploit payload establishes a reverse shell to a configurable IP and port, which is the disclosed purpose of the PoC.evil.go:51-59

Network Namespace Escape

Payload withheldThe exploit switches to the host network namespace to escape container isolation, consistent with the CVE description.evil.go:22-33

Default Connection Target

Payload withheldDefault fallback IP and port if TARGET_IP/TARGET_PORT environment variables are not set. This is a common Docker bridge IP, not a concealed third-party address.evil.go:44-49