# CVE-2026-107935: Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose Status: published. Published: 2026-10-09. Updated: 2026-11-04. A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system. ## Remediation No remediation reported in collected sources ## Affected products and versions - / (gvisor-tap-vsock): ≥ 0.4.0; < 0.9.0 (affected, semver). Source: CNA: redhat - Red Hat / Red Hat Build of Podman Desktop (rh-podman-desktop): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Certification Program for Red Hat Enterprise Linux 9 (rhcertification/redhat-certification-system-ai-10): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Edge Manager 1 (rhem/flightctl-imagebuilder-worker-rhel10): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (gvisor-tap-vsock): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (rhel10/bootc-image-builder): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (rhel10-eus/rhel-10.0-bootc): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (rhel10-eus/rhel-10.2-bootc): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (rhel10/rhel-bootc): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (ubi10/podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8 (container-tools:rhel8/podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (gvisor-tap-vsock): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Hardened Images (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (openshift4/microshift-bootc-rhel10): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 5 (openshift5/microshift-bootc-rhel10): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Dev Spaces (devspaces/udi-base-rhel10): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenStack Platform 18.0 (rhoso-operators/prometheus-podman-exporter-rhel9): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 9.3 (critical); CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H; source: CNA: redhat - CVSS 3.1: 9.3 (critical); CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H; source: NVD: secalert@redhat.com - CISA KEV: No listing in collected sources - EPSS: 0.24% as of 2026-11-04; percentile 15.06% - SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP - Weaknesses: CWE-22 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/security/cve/CVE-2026-107935 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2548382 (CNA: redhat; issue-tracking, x_refsource_REDHAT) - https://github.com/containers/gvisor-tap-vsock/pull/718 (CNA: redhat) - https://redhat.atlassian.net/browse/RHDESK-550 (CNA: redhat) - https://access.redhat.com/security/cve/CVE-2026-107935 (secalert@redhat.com) - https://bugzilla.redhat.com/show_bug.cgi?id=2548382 (secalert@redhat.com) - https://github.com/containers/gvisor-tap-vsock/pull/718 (secalert@redhat.com) - https://redhat.atlassian.net/browse/RHDESK-550 (secalert@redhat.com) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-107935; retrieved 2026-11-04; source updated 2026-11-04 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107935; retrieved 2026-11-05; source updated 2026-11-04 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-107935; retrieved 2026-11-04; source updated Not reported Revision: 1c27fd92d2588392d95b4cc5efea286dae3456b81414948b7b5c19a45fc3a501 Canonical: https://y2.dev/cve/CVE-2026-107935 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.