CVE-2026-31431: rootless container copy-fail privilege escalation

Sat, 10 Oct 2026 16:14:00 +0000

Engineer — Act: CISA KEV listing confirms active exploitation despite the low EPSS (0.03); audit all rootless container deployments (podman, Docker rootless, or equivalent) and apply vendor patches for CVE-2026-31431 immediately — public PoC lowers the bar for attackers further.
SOC/IR — Act: KEV listing means assume exploitation is occurring; hunt for anomalous file-copy operations and privilege escalation events on container hosts, sweeping logs back to at least May 2026 when the PoC was published.
Leader — Plan: A KEV-listed container vulnerability merits confirming with engineering that CVE-2026-31431 is in the patch queue with a firm timeline this week, but it does not rise to board or customer disclosure level unless containers underpin a regulated or critical-path service.
Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub

Containers on CuraSec