Container Escape via Rootful Passt Networking in crun

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-84042 represents a critical container escape vulnerability in crun versions 1.29 and later when built with libkrun and configured for rootful containers using passt networking. This flaw allows an attacker to execute arbitrary payloads from a container image with full host root privileges, effectively breaking container isolation boundaries. The vulnerability is particularly concerning because it requires no additional exploitation steps—simply starting a rootful container with passt networking enabled triggers the attack path. Organizations running containerized workloads on Linux systems using crun as their runtime, especially those leveraging krun for lightweight virtualization, face immediate risk of host compromise and lateral movement throughout their infrastructure.

Casky's 224 matched security skills map this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation), enabling practitioners to detect the attack patterns through behavioral analysis powered by Claude AI's extended reasoning. Security teams using Casky would identify suspicious indicators such as: container processes spawning host-level binaries with elevated privileges, unexpected network socket creation bypassing normal container namespacing, and image payloads executing outside expected containerized contexts. The platform's skill-based detection framework allows practitioners to correlate container escape attempts with privilege escalation indicators across their environment, flagging the regression introduced in crun 1.29 as part of their threat hunting workflows. By analyzing process trees, capability grants, and namespace violations, Casky helps teams distinguish this specific rootful passt networking exploitation pattern from other container attack vectors.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84042.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-84042

Casky has 224 skills that investigate the attack patterns behind CVE-2026-84042. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn