{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/containers/gvisor-tap-vsock","packageName":"gvisor-tap-vsock","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"0.9.0","status":"affected","version":"0.4.0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rh-podman-desktop","product":"Red Hat Build of Podman Desktop","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhcertification/redhat-certification-system-ai-10","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhem/flightctl-imagebuilder-worker-rhel10","product":"Red Hat Edge Manager 1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gvisor-tap-vsock","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"podman","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel10/bootc-image-builder","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel10-eus/rhel-10.0-bootc","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel10-eus/rhel-10.2-bootc","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel10/rhel-bootc","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ubi10/podman","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"container-tools:rhel8/podman","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gvisor-tap-vsock","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"podman","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"podman","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/microshift-bootc-rhel10","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"podman","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/microshift-bootc-rhel10","product":"Red Hat OpenShift Container Platform 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/prometheus-podman-exporter-rhel9","product":"Red Hat OpenStack Platform 18.0","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-107935","cwes":["CWE-22"],"description":"A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.","epss":{"date":"2026-11-04","percentile":0.15058,"score":0.00239},"exploits":[],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: redhat","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},{"score":9.3,"severity":"critical","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1793830665990,"publishedAt":1791536743726,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-107935"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548382"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/containers/gvisor-tap-vsock/pull/718"},{"source":"CNA: redhat","tags":[],"url":"https://redhat.atlassian.net/browse/RHDESK-550"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-107935"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548382"},{"source":"secalert@redhat.com","tags":[],"url":"https://github.com/containers/gvisor-tap-vsock/pull/718"},{"source":"secalert@redhat.com","tags":[],"url":"https://redhat.atlassian.net/browse/RHDESK-550"}],"remediation":[],"revision":"1c27fd92d2588392d95b4cc5efea286dae3456b81414948b7b5c19a45fc3a501","sources":[{"modifiedAt":1793828524826,"name":"CNA: redhat","retrievedAt":1793830292218,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107935"},{"modifiedAt":1793830665990,"name":"NVD","retrievedAt":1793838072096,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107935"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793830323122,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107935"}],"ssvc":{"assessedAt":1791575080428,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose","updatedAt":1793838072096}