Description
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| apptainer | apptainer | >= 1.2.0-rc.2, < 1.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | apptainer | 1.3.0-bp155.3.3.2 | openSUSE-SU-2024:0244-1 |
| SUSE Package Hub 15 SP5 | squashfuse | 0.5.0-bp155.2.1 | openSUSE-SU-2024:0244-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apptainer | 1.2.1-1.1 | openSUSE-SU-2024:13073-1 |
| openSUSE Leap 15.5 | apptainer | 1.3.0-bp155.3.3.2 | openSUSE-SU-2024:0244-1 |
| openSUSE Leap 15.5 | squashfuse | 0.5.0-bp155.2.1 | openSUSE-SU-2024:0244-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/apptainer/apptainer | >= 1.2.0, < 1.2.1 | 1.2.1 | GHSA-mmx5-32m4-wxvx |
Advisories 2
- openSUSE-SU-2024:13073-1 apptainer-1.2.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0244-1 Security update for apptainer SUSE / openSUSE Security Updates · Feb 4, 2026