Description
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected. This issue is fixed in SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sylabs | singularity | < 4.4.2 | — |
| sylabs | SingularityPRO | < 4.1.14, >= 4.2.0, < 4.3.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | singularity-container | No fix yet | — |
| Ubuntu 25.10 | singularity-container | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | singularity-container | No fix yet | — |
| Ubuntu Pro 18.04 LTS | singularity-container | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | singularity | 4.4.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sylabs/singularity | <= 3.1.1 | — | GHSA-wqcr-7rf3-f64m |
| Go | github.com/sylabs/singularity | all versions | — | GO-2026-5715 |
| Go | github.com/sylabs/singularity/v4 | < 4.4.2 | 4.4.2 | GHSA-wqcr-7rf3-f64m |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
References
- https://github.com/sylabs/singularity/security/advisories/GHSA-wqcr-7rf3-f64m
- https://github.com/sylabs/singularity/pull/4152
- https://github.com/sylabs/singularity/commit/c08791793e843d4c9c1f2fc1d9d12abef747378f
- https://github.com/sylabs/singularity/commit/c1dc9470a769e6e534b588a4ed521768ca4fc0d1
- https://github.com/sylabs/singularity/releases/tag/v4.4.2