CVE-2026-113957 in container
Summary
by MITRE • 10/29/2026
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The described vulnerability represents a critical integrity failure within container runtime systems, specifically affecting the mechanism by which images are pulled from remote registries using content-addressable identifiers known as digests. In standard container operations, users often pin specific image versions by their cryptographic digest to ensure reproducibility and security, relying on the assumption that fetching an image via its unique hash guarantees retrieval of exactly that version. However, when an attacker gains control over the registry infrastructure, a network mirror, or possesses the ability to perform man-in-the-middle attacks along the network path, they can intercept these requests and serve arbitrary malicious content instead of the intended artifact. This scenario allows for supply chain compromise where a user inadvertently executes code from an unverified source despite explicitly requesting a specific trusted version, effectively bypassing the security guarantees provided by digest-based pinning.
The technical flaw stems from insufficient validation logic during the image retrieval process prior to its application in container environments. While the system may request data based on a specified hash, it historically failed to rigorously verify that the received payload matched this expected identifier before proceeding with execution or storage. This lack of strict verification creates an opportunity for content substitution attacks where the runtime accepts any blob presented by the registry endpoint regardless of whether its actual cryptographic fingerprint aligns with the requested digest. Such behavior undermines the fundamental principle of content-addressable storage, which relies on the immutability and verifiability of data identifiers to maintain trust in distributed systems.
To mitigate this risk, the remediation strategy involves implementing strict integrity checks at multiple layers of the container fetching pipeline. The fix introduces a validation step that compares the digest of the returned image manifest against the pinned digest specified by the user operation; if these values do not match exactly, the pull process is aborted immediately to prevent the installation or execution of unverified content. Additionally, the solution extends this verification to include hashing checks for both manifests and individual blobs during their fetch operations, ensuring end-to-end integrity throughout the download sequence. It is important to note that tag-based pulls remain exempt from these strict digest comparisons because container tags are inherently mutable by design, meaning they point to changing references rather than fixed immutable artifacts, making such verification logically inconsistent with standard tagging practices.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-345 Insufficient Verification of Data Authenticity within the Common Weakness Enumeration framework, as it involves failing to adequately verify that received data matches expected integrity constraints. From a threat modeling perspective using MITRE ATT&CK techniques, this flaw facilitates Supply Chain Compromise by allowing attackers to inject malicious artifacts into trusted workflows through registry manipulation or network interception. Organizations utilizing containerized environments should ensure they upgrade to the specified patched versions of container and containerization software to restore trust in image integrity mechanisms. Furthermore, administrators are advised to implement additional defensive measures such as using private registries with strict access controls, employing TLS for all communications, and considering digital signature verification tools like Notary or Cosign to provide an extra layer of assurance beyond simple digest matching.