Act
active
CVE-2026-31431: rootless container copy-fail privilege escalation
- Engineer — Act: CISA KEV listing confirms active exploitation despite the low EPSS (0.03); audit all rootless container deployments (podman, Docker rootless, or equivalent) and apply vendor patches for CVE-2026-31431 immediately — public PoC lowers the bar for attackers further.
- SOC/IR — Act: KEV listing means assume exploitation is occurring; hunt for anomalous file-copy operations and privilege escalation events on container hosts, sweeping logs back to at least May 2026 when the PoC was published.
- Leader — Plan: A KEV-listed container vulnerability merits confirming with engineering that CVE-2026-31431 is in the patch queue with a firm timeline this week, but it does not rise to board or customer disclosure level unless containers underpin a regulated or critical-path service.
- Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.