CVE-2026-40226
published 2026-04-10CVE-2026-40226: In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
PriorityP427medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
EPSS
0.07%
0.1th percentile
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| systemd | systemd | >= 233 < 260 | 260 |
| systemd_project | systemd | >= 233 < 257.12 | 257.12 |
| systemd_project | systemd | >= 258 < 258.6 | 258.6 |
| systemd_project | systemd | >= 259 < 259.4 | 259.4 |
| ubuntu | systemd | — | — |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.4MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
systemd vulnerabilities
vendor_ubuntu·2026-06-08·CVSS 5.9
CVE-2026-40226 [MEDIUM] systemd vulnerabilities
Title: systemd vulnerabilities
Summary: Several security issues were fixed in systemd.
It was discovered that systemd-nspawn incorrectly handled certain optional
configuration files. A local attacker could possibly use this issue to
escape to the host system and execute arbitrary code. (CVE-2026-40226)
It was discovered that systemd-resolved incorrectly validated DNSSEC
records for signed domains. An attacker could possibly use this issue to
manipulate DNS records. This issue only affected Ubuntu 22.04 LTS.
(CVE-2023-7008)
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Red Hat
systemd: systemd nspawn: Escape-to-host action via crafted config file
vendor_redhat·2026-04-10·CVSS 6.4
CVE-2026-40226 [MEDIUM] CWE-348 systemd: systemd nspawn: Escape-to-host action via crafted config file
systemd: systemd nspawn: Escape-to-host action via crafted config file
A flaw was found in nspawn, a container runtime environment within systemd. A local attacker or a process within an nspawn container could exploit this vulnerability by using a specially crafted optional configuration file. This could allow the attacker to escape the container's isolation and execute arbitrary actions on the host system.
Package: NetworkManager (Red Hat Enterprise Linux 10) - Not affected
Package: rpm-ostree (Red Hat Enterprise Linux 10) - Not affected
Package: systemd (Red Hat Enterprise Linux 10) - Not affected
Package: systemd (Red Hat Enterprise Linux 7) - Not affected
Package: NetworkManager (Red Hat Enterprise Linux 8) - Not affected
Package: systemd (Red Hat Enterprise Linux 8) - Not affec
GHSA
GHSA-hc7r-6254-88w5: In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file
ghsa_unreviewed·2026-04-10
CVE-2026-40226 [MEDIUM] CWE-348 GHSA-hc7r-6254-88w5: In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
No detection rules found.
No public exploits indexed.
2026-04-10
Published