CVE-2026-64777

Executive Summary

CVE-2026-64777 is a path traversal vulnerability (CWE-22) affecting Apple's Container build tool, version 1.2.0 and earlier. A malicious builder peer can request an in-context file by name from the host and receive the contents of that file even when the resolved path falls outside the designated build context. With a CVSS score of 4.3 (Medium), this vulnerability enables low-privileged network attackers to perform unauthorized read operations on the container host's filesystem, potentially exposing sensitive configuration data, credentials, or source code. The vulnerability is addressed in container version 1.2.0; however, patch confirmation is rated at only 2/4 confidence, as a single source (NVD) claims the fix without independent verification.

Technical Analysis

CVE-2026-64777 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — commonly known as "Path Traversal"). The vulnerability resides in the file-serving mechanism of Apple's Container tool, which manages build contexts for containerized application builds.

Vulnerability Mechanism: The flaw occurs when a builder peer — an entity participating in a distributed or parallelized build process — requests a file by name from the host system. The container build tool fails to properly validate that the resolved file path remains within the build context directory. Instead of canonicalizing the requested path and verifying it starts with the allowed base directory, the tool naively resolves the name to its final destination on the host filesystem. This allows an attacker to request files by absolute paths or via traversal sequences such as ../../etc/passwd or direct absolute references.

Attack Surface: The attack surface is the peer-to-peer build communication interface. In Apple's container build architecture, a host process coordinates build tasks with builder peers. The host exposes a file-serving API that builder peers use to retrieve build context files. Because the flaw is in the host's file resolution logic, any peer — such as a compromised or malicious build node, or an attacker who can inject themselves into the build orchestration network — can exploit this.

Underlying Issue: The root cause is a classic lack of input canonicalization. The host must:

1. Resolve the requested filename to a canonical path (e.g., using realpath() or equivalent),
2. Verify the canonical path is prefixed by the canonical build context directory,
3. Only then serve the file.

The vulnerable implementation appears to skip step 2, or performs an insufficient check that can be bypassed (such as a string-prefix check that fails against ../ sequences or symlink-based path redirection).

Affected Systems: Container versions prior to 1.2.0 are affected. The fix in version 1.2.0 presumably adds proper path validation and containment checks.

Exploitation Scenarios

Prerequisites: The attacker must be a network-accessible builder peer. This means the attacker needs network access to the host's build orchestration service (port unspecified in available data) and the ability to send authenticated or unauthenticated file requests, depending on how peer authentication is configured. The CVSS vector indicates low privileges required (PR:L), meaning some minimal level of access or valid peer credentials may be needed.

Recommendation: "No public PoC available; attack chain is inferred from vulnerability class."

Attack Chain Steps:

1. Reconnaissance/Target Identification: The attacker identifies a host running Apple Container versions prior to 1.2.0. This could be discovered via network scanning for known build-orchestration service ports (if any are documented publicly). Alternatively, in a supply-chain scenario, the attacker is already a legitimate (or compromised) builder peer in the build network.

2. Triggering the Flaw: The attacker sends a file request to the host's file-serving interface. The request specifies a filename intentionally crafted to escape the build context. Examples at the class level include:

   • Absolute path request: requests.get("http://host:port/file?name=/etc/passwd")-style requests
   • Relative traversal: ../../../../etc/shadow
   • Symlink-based escape: requesting a symlink inside the build context that points outside it

3. Payload/Execution Method (Vulnerability-Class Level): Path traversal via insufficient path validation. The attacker submits a file request where the "name" parameter contains traversal sequences or absolute paths. The host resolves the name to a filesystem path without enforcing containment within the build context directory, then transmits the file contents back to the requesting peer.

4. Post-Exploitation Impact: Successful exploitation yields contents of arbitrary host files readable by the container process's user. Typical targets include:

   • /etc/passwd (user enumeration)
   • /etc/shadow (hash extraction, if readable)
   • Environment files or .env containing API keys and secrets
   • SSH private keys (e.g., /home/user/.ssh/id_rsa)
   • Cloud provider credentials (~/.aws/credentials, ~/.config/gcloud/)
   • Source code or proprietary files outside the build context
   • Do not forget that the CVSS vector shows only Confidentiality impact (C:L) with no Integrity or Availability impact.

Note: The specific HTTP request structure, parameter names, and API endpoints are not disclosed in the available data. The above scenario describes the vulnerability-class-level attack mechanics without fabricating implementation details.

Impact Assessment

CVSS Analysis (Score: 4.3, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N):

• Attack Vector: Network — exploitable remotely
• Attack Complexity: Low — no special conditions required
• Privileges Required: Low — attacker needs basic peer-level access
• User Interaction: None — no victim action required
• Scope: Unchanged — impact confined to the vulnerable component
• Confidentiality: Low — limited file disclosure, but the scope of files could be broad
• Integrity: None — no data modification
• Availability: None — no denial of service

Business Impact:

• Confidentiality Breach: The core impact is unauthorized file disclosure. While the CVSS rating caps this at "Low," the actual exposure depends on what files reside outside the build context. In typical deployments, this includes secrets, configuration files, and application source code, which could significantly elevate the practical risk.
• Supply Chain Risk: This vulnerability is particularly dangerous in multi-tenant or distributed build environments where third-party builders are lower-trust. A malicious builder peer could exfiltrate host secrets.
• Lateral Movement Enabler: Disclosed credentials (SSH keys, cloud tokens, database passwords) could facilitate lateral movement into cloud infrastructure or internal systems.
• Compliance: Exposure of regulated data (PII in config files, payment processing keys) may trigger breach reporting obligations.
• EPSS Note: The EPSS score of 0.00227 (13.2% percentile) indicates a low probability of exploitation in the wild at the time of scoring. This is likely because Container is a specialized tool with limited deployment compared to mainline systems.

Affected Systems: Enterprise environments using Apple Container for build automation, CI/CD pipelines, or container image construction where untrusted or semi-trusted builder peers participate in build orchestration.

Detection Guidance

Note: Since no public exploit or PoC is available, and the specific file request mechanism is undisclosed, the following detection rules monitor for generic path traversal indicators and anomalous file access patterns in build host environments.

Sigma Rule

title: Path Traversal Attempt Against Apple Container Build Service
id: 3f7a9c1e-8b4d-4e2a-9c6f-1d5a8e3b7c02
status: experimental
description: Detects path traversal sequences in file requests to Apple Container build hosts, indicating possible CVE-2026-64777 exploitation attempts.
author: Valtersit Threat Intelligence
date: 2026-01-15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 
            - GET
            - POST  
        cs-uri-query|contains:
            - "..%2f"
            - "%2e%2e%2f"
            - "..%5c"
            - "..%252f"
            - "/etc/passwd"
            - "/etc/shadow"
            - "/root/.ssh/"
            - "file:///"
            - "file_name=/"
    condition: selection
falsepositives:
    - Legitimate application requests containing traversal-like strings (rare)
    - Monitoring tools that test for path traversal
level: medium
tags:
    - attack.t1190
    - cve.2026-64777
    - cwe.22

YARA Rule

rule CVE_2026_64777_PathTraversal_Container
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal sequences targeting Apple Container file-serving interface"
        cve = "CVE-2026-64777"
        reference = "NVD"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $t1 = "../" ascii
        $t2 = "..%2f" ascii nocase
        $t3 = "%2e%2e%2f" ascii nocase
        $t4 = "/etc/passwd" ascii nocase
        $t5 = "/etc/shadow" ascii nocase
        $t6 = "/etc/ssh/" ascii nocase
        $t7 = ".ssh/id_rsa" ascii nocase
        $t8 = "filename=" ascii nocase
        $t9 = "file_name=" ascii nocase
        $t10 = "container build" ascii nocase
    condition:
        (any of ($t1*) or any of ($t4*)) and 
        (any of ($t8*)) or
        (any of ($t9*) and (any of ($t1*) or any of ($t2*) or any of ($t3*)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-64777 Apple Container Path Traversal Attempt"; 
flow:established,to_server; 
content:"GET"; http_method; 
content:"/file"; http_uri; 
pcre:"/(\.\./[0-9a-zA-Z_\.\/]*|%2e%2e%2f[0-9a-zA-Z_\.\/]*|\.\.%2f)/Ui"; 
classtype:attempted-recon; 
sid:2026647771; 
rev:1; 
reference:cve,2026-64777; 
reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-64777; 
metadata:created_at 2026-01-15;)

This rule triggers on HTTP requests to a /file URI (assumed pattern) containing traversal sequences. Adjust the URI pattern if different endpoints are discovered.

Elastic Detection

sequence by source.ip with maxspan=1m
  [any where process.name == "container-buildd" and 
   event.action in ("open", "read", "stat") and 
   file.path like "*..*"]
  [any where network.direction == "egress" and 
   network.protocol == "http" and 
   http.request.body.content like "*../*"]

Alternatively, a simpler EQL for web requests:

any where network.protocol == "http" and 
  url.path like "*file*" and 
  (url.query like "*../*" or url.query like "*..%2f*" or url.query like "*%2e%2e*")

Splunk SPL Query

index=main sourcetype=container_build host=build_host
| where match(_raw, "\.\./|%2e%2e%2f|\.\.%2f|/etc/passwd|/etc/shadow")
| stats count by src_ip, uri_path, http_status, _time
| table _time, src_ip, uri_path, http_status, count

Or with explicit fields:

index=main (sourcetype="container_build_logs" OR sourcetype="container_build_http")
| spath input=request_data
| search request_data.uri_path="*file*" AND (request_data.uri_query="*..%2f*" OR request_data.uri_query="*%2e%2e%2f*" OR request_data.uri_query="*/etc/passwd*" OR request_data.uri_query="*/etc/shadow*")
| eval malicious=case(
    match(request_data.uri_query, "\.\./") OR match(request_data.uri_query, "%2e%2e%2f") OR match(request_data.uri_query, "/etc/passwd"), "path_traversal",
    1=1, "review")
| stats count by src_ip, dest_ip, uri_path, malicious, _time

Wazuh OSSEC Rule

<group name="container_build_local,">
  <rule id="100777" level="10">
    <if_sid>510</if_sid>
    <field name="url" type="pcre2">.*\/file\?.*(\.\.|%2e%2e|\.\.%2f).*</field>
    <description>CVE-2026-64777: Path traversal attempt against Apple Container build file service</description>
    <group>web_application_attack,path_traversal,cve_2026_64777,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

For host-based detection:

<group name="container_build,">
  <rule id="100778" level="8">
    <if_sid>510</if_sid>
    <command>audit_linux</command>
    <match>container-buildd.*file.*(\.\.|/etc/passwd|/etc/shadow)</match>
    <description>CVE-2026-64777: Container build daemon accessed out-of-context file path</description>
    <group>cve_2026_64777,path_traversal,</group>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed.)

The NVD states the vulnerability is addressed in container version 1.2.0. However, with only a single source confirming this fix and no vendor advisory or independent verification, verify before treating this as final.

Immediate Mitigations:

1. Restrict Network Access: If upgrading is not immediately possible, restrict network access to the container build host's file-serving service. Use firewalls to limit connections to only known and trusted build peer IP addresses.
2. Enforce Peer Authentication: Ensure that all builder peers authenticate with strong credentials or certificates. Disable anonymous peer access if supported.
3. Monitor and Alert: Implement the detection rules above to monitor for path traversal attempts and anomalous file access patterns.
4. Harden Host Filesystem: Apply least-privilege principles to the service account running the container build host. Ensure it has read access only to necessary directories. Restrict the account's ability to read sensitive files (e.g., /etc/shadow, SSH keys, cloud credentials).
5. Temporary Workarounds: If configuration allows, disable the file-serving feature or restrict it to a read-only, sandboxed directory. Check for configuration options to enable strict path validation if available.

Patch/Upgrade Steps:

1. Verify the current version: container --version (command name not specified in data, use the actual binary name for your deployment).
2. Upgrade to container version 1.2.0 or later. Download from the official Apple developer or distribution channel.
3. After upgrading, verify the path traversal fix by attempting to request an out-of-context file (e.g., /etc/passwd) and confirming the request is denied.
4. Validate that legitimate build workflows still function correctly after the upgrade.

Long-Term Hardening:

1. Run Build Hosts in Isolation: Run container build hosts in isolated environments (VMs, containers) to minimize the blast radius of any file disclosure.
2. Secrets Management: Do not store secrets on build hosts. Use dedicated secrets management solutions (e.g., HashiCorp Vault, cloud secret managers).
3. Build Peer Trust: Treat all builder peers as semi-trusted; enforce the principle of least privilege on any peer-to-peer build communication.
4. Segregation: Separate build infrastructure from production systems on the network to limit the impact of compromised build nodes.
5. Continuous Monitoring: Maintain the detection rules above as part of your continuous security monitoring stack.
6. Vendor Communication: Monitor Apple's official advisory channels for additional details on CVE-2026-64777 and any follow-up patches.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-64777 — Official CVE record with description, CVSS score, and reference to the fix in version 1.2.0.
2. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html — MITRE Common Weakness Enumeration reference for improper limitation of path names.
3. Apple Developer Documentation: Refer to Apple's official container tool documentation for version-specific information and upgrade guidance. Exact URL not available at time of writing; consult Apple Developer portal.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique mapping for this vulnerability.
5. First.org CVSS v3.1 Specification: https://www.first.org/cvss/specification-document — CVSS vector explanation for interpreting the score and vector semantics.

Threat Actor Activity: No known threat actor campaigns or active exploitation in the wild have been identified as of the date of this report. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00227 (13.2% percentile) indicates a low probability of active exploitation. However, the vulnerability class (path traversal) is well-understood and trivial to exploit once PoCs surface; monitoring should remain active.

Note: This report is based solely on the NVD description and metadata provided. Specific implementation details (API endpoints, parameter names, file paths) are not disclosed in the available data and have therefore not been fabricated.