Security Update for Apptainer

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-48785


The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2609-1 advisory.

    This update for apptainer fixes the following issues

    - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes     with target       cache path traversal (bsc#1264177).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260311).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265844).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262956).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266656).
    - CVE-2026-39827: memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-39828: bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-39829: pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-39830: client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-39831: bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-39832: agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266202).
    - CVE-2026-39833: key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266202).
    - CVE-2026-39834: infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-39835: server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-42508: auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts       (bsc#1266202).
    - CVE-2026-46595: VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-46597: byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-46598: pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266202).
    - CVE-2026-48785: incorrect path matching for limit container paths directive (bsc#1267982).

    Changes for apptainer:

    - Update apptainer to version v1.5.1

     * Work around segmentation fault sometimes seen while `mksquashfs`      under proot is creating a SIF file.
     * Update bundled PRoot to version 5.4.0-rootless.3 in order to      fix a problem where SIF files could be corrupted when      `mksquashfs` died with a signal. The proot command was not      passing back an error exit code.
     * Updated bundled `squashfuse_ll` to version 0.6.2 in order to      fix a crash sometimes seen with apptainer in unprivileged      docker.
     * Update bundled fuse2fs to version 1.47.4 instead of patching      the bugs in 1.47.3.
     * Fix a crash that happened when `/etc/resolv.conf` was a      symlink while building from a definition file using the      localimage bootstrap.
     * Support hosts that have an /etc/resolv.conf symlink pointing      to `../run` in addition to `/run`.
     * Change the download-dependencies script to skip downloading      the PRoot source code on architectures that it is known to      not support (that is: ppc*, s390*, and riscv*).
     In those situations Apptainer will skip trying to compile      and run proot. As a result original owners and groups of      files will not be preserved in SIF images built by      unprivileged users, as was the case for all architectures      prior to 1.5.0.
     * Fix panic encountered during progress bar update while      pulling image.
     * Fix fakeroot overwriting root's username in `/etc/passwd`      with the host user's name, a regression introduced in v1.5.0.
     * Add nonested flag for --mount specifications to prevent      individual bind mounts from being passed to nested containers      via `APPTAINER_BIND`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The vulnerability exists due to an incorrect string prefix evaluation within the path-matching logic for     the limit container paths directive in Apptainer, which mistakenly allows non-isolated directory names to     match if they share a string prefix with an allowed path (e.g., matching a forbidden /scratch2 directory     because it starts with an authorized /scratch), enabling a local attacker to execute containers from     unapproved host directories. (CVE-2026-48785)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20942-1 advisory.

    Changes in apptainer:

    - Update apptainer to version v1.5.1
      * Security fix (bsc#1267982):
        Fix for CVE-2026-48785 / GHSA-cr2j-534f-mf3g. Incorrect path         matching for limit container paths directive. This is only         applicable to SUID installations that have paths listed in         limit container paths that are string prefixes of other paths         which are not desired to be included in the list. For example,         if /scratch is in the list but `/scratch2` also exists and contains         container images, previously the latter would match but now         only images under the exactly matching `/scratch` are included.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ff5370cd61 advisory.

    Update to upstream 1.5.1.  Fixes CVE-2026-48785

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-77b4ea4fb8 advisory.

    Update to upstream 1.5.1.  Fixes CVE-2026-48785

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
443991	SCA: security update for github.com/apptainer/apptainer (GHSA-cr2j-534f-mf3g)	Tenable Cloud Security	SCA Checks	Local	medium
443991	SCA: security update for github.com/apptainer/apptainer (GHSA-cr2j-534f-mf3g)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
323089	SUSE SLES15 Security Update : apptainer (SUSE-SU-2026:2609-1)	Nessus	SuSE Local Security Checks	Local	high
322448	Linux Distros Unpatched Vulnerability : CVE-2026-48785	Nessus	Misc.	Local	critical
321006	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20942-1)	Nessus	SuSE Local Security Checks	Local	medium
320955	Fedora 44 : apptainer (2026-ff5370cd61)	Nessus	Fedora Local Security Checks	Local	critical
320932	Fedora 43 : apptainer (2026-77b4ea4fb8)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-48785

medium

Tenable Plugins

Coming Soon

medium

medium

high

critical

medium

critical

critical