CVE-2026-5555 – Container Escape via /proc/self/fd Symlink

Overview

A shared volume mounted with rshared propagation allows a malicious container to create a symbolic link pointing to a host file through /proc/self/fd. The host process writing to the volume follows the symlink, overwriting critical host files and escaping the container.

Vulnerability Details

• Type: Container Escape / Symlink Attack
• Impact: Host file overwrite, privilege escalation to root on host.
• Root Cause: The container runtime does not prevent symlink creation pointing outside the container’s mount namespace via procfs trickery.

Exploit Demonstration

1. Start the simulated host logging service:
   root@kitploit:~

   python vulnerable_container_engine.py
   

2. In a separate terminal (acting as the malicious container), run:
   root@kitploit:~

   python exploit_container_escape.py