r0binak/CVE-2026-46680

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Dockerfile that builds an image designed to exploit CVE-2026-46680 by adding a passwd entry mapping a large numeric UID (4294967296) to root, then setting the USER directive to that same large number, causing a container to run as root despite runAsNonRoot restrictions.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a Dockerfile and a README. The Dockerfile demonstrates the CVE-2026-46680 vulnerability by adding a large numeric UID to /etc/passwd and setting the USER directive to that value. No backdoor, concealed executable, or operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesDockerfile
Target softwarecontainerd
Attack typesprivilege escalationcontainer escape
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Dockerfile is a complete, self-contained artifact that, when built and run on a vulnerable containerd instance, exercises the CVE-2026-46680 vulnerability to achieve privilege escalation. It actively constructs the conditions for the vulnerability (crafted /etc/passwd) and triggers the flawed USER parsing to run as root, which is the definition of exploit code.

Dockerfile:1-4README.md:2

Requirements

  • A vulnerable version of containerd (prior to 1.7.32, 2.0.9, 2.2.4, 2.3.1) must be used to run the container.Dockerfile:1-4
  • The container must be launched with a runAsNonRoot restriction (e.g., in Kubernetes) that the exploit is intended to bypass.Dockerfile:1-4

Observed behavior

  • The Dockerfile adds an /etc/passwd entry mapping UID 4294967296 to username 'x' with UID 0 (root).Dockerfile:2
  • The Dockerfile sets the USER directive to 4294967296, a number that cannot be parsed as a 32-bit integer, causing containerd to treat it as a username.Dockerfile:3
  • The container's CMD runs 'id' to demonstrate the effective UID, which would be 0 if the exploit succeeds.Dockerfile:4
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
Dockerfile adds '4294967296:x:0:0:root:/root:/bin/bash' to /etc/passwd and sets USER 4294967296Demonstrates the CVE-2026-46680 runAsNonRoot evasion by mapping a large numeric string to root (UID 0).Dockerfile:2-3
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the Dockerfile and README.md; one additional text file is reported in metadata but its content is not provided, so its role cannot be assessed.
  • The analysis is based solely on static review of the supplied text; the artifact was not executed, and its behavior in a live environment is not confirmed.
  • One file (metadata only) was omitted from text review; its content is unknown.
  • Binary files were not analyzed; none were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2026-46680Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile that builds an Alpine Linux image, adds a user entry with UID 4294967296 to /etc/passwd, sets that user as the default, and runs a shell that prints the current user ID then sleeps.

Dockerfile:1-4

Lab assessment

Vulnerability lab

The README explicitly states 'CVE-2026-46680 exploit' and the Dockerfile creates a user with UID 4294967296, which is a 32-bit overflow value (2^32) commonly associated with integer overflow vulnerabilities in user ID handling. This strongly suggests the environment is designed to demonstrate or test a specific CVE.

README.md:1-2Dockerfile:2
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds a container image with a specific user ID overflow scenario

The Dockerfile starts from alpine:latest, appends a user entry with UID 4294967296 (which overflows a 32-bit unsigned integer) to /etc/passwd, sets that user as the default, and runs a command to print the current user ID and sleep.

Dockerfile:1-4
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-46680

Insufficient evidence

The README mentions CVE-2026-46680 and the Dockerfile creates a user with UID 4294967296, which is a 32-bit overflow value. This is consistent with a vulnerability related to integer overflow in user ID handling, but no exploit code, vulnerable software, or detailed vulnerability description is provided. The evidence is insufficient to confirm or refute the CVE association.

README.md:1-2Dockerfile:2
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the image.Dockerfile:1-4

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-4
  2. Run a container from the built image. The container will execute 'id' to display the current user ID (likely showing the overflow value) and then sleep.Dockerfile:4
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile only adds a user entry and runs 'id' and 'sleep'. There are no network connections, host mounts, privilege escalations, or destructive commands. The behavior is entirely contained within the container and appears to be a minimal demonstration of a user ID overflow.

Dockerfile:1-4
Review boundaries

What the analysis did not establish

  • The packet does not include the pod.yaml file content, so its role is unknown.
  • No exploit code or vulnerable software is present; the CVE association cannot be verified.
  • The Dockerfile uses 'alpine:latest' which may change over time, affecting reproducibility.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1