Blog
Kiri Subscribe

Containers midweek: 28 October – 4 November 2026

Upwind raises $400M, groundcover rightsizes Kubernetes for you, OpenKruise fences in AI agents, and a Critical Docker Desktop escape to patch today.

By 8 min readContainersSecurity

What happened in the container world this week: what to patch, what launched, who raised money, then the details. Every item links to where it was published. Check the vendor’s advisory before you act on a version number.

Patch these first

  • Docker Desktop on Windows, if you use the WSL 2 backend: update both Docker Desktop (4.98.0) and WSL (3.0.3). Updating only one leaves a Critical container escape open.
  • Docker Swarm: upgrade to Docker Engine 29.9.3. A stolen worker certificate can become a manager.
  • Rancher: upgrade to 2.15.3, 2.14.7, 2.13.11, 2.12.15 or 2.11.19. Any signed-in user can get a shell on the management cluster.
  • Harbor: upgrade to 2.15.3 or 2.14.6, or block PUT /api/v2.0/users at your proxy. One unauthenticated request takes the registry down.

Launches

  • groundcover Autonomous Infrastructure (beta, 3 November) rightsizes the CPU and memory requests of Kubernetes workloads from how they really behave in production. It checks how full a node is before raising a request, so one workload’s increase doesn’t starve its neighbours. During the beta it changes requests only, not limits; it stays off until an engineer picks the deployments, namespaces or clusters it may touch; and every change stays inside set bounds, with an audit log. Free for existing groundcover customers. (SiliconANGLE)
  • OpenKruise Agents v0.6.0 (3 November), a Kubernetes-native sandbox for AI agents with an E2B-compatible API. It adds egress rules, inspection of MCP tool calls with per-tool allow lists, API keys injected by the egress proxy so they never enter the sandbox, warm pools that scale themselves, and automatic pause and resume. The release notes are honest about the gap: containers running as root or with NET_ADMIN can get around the network controls. (CNCF blog)
  • Amazon EKS Auto Mode now supports the Gateway API (28 October). Gateway and HTTPRoute work with no controller to install, with HTTP and gRPC routing, weighted traffic splitting, header-based routing and certificates found automatically in AWS Certificate Manager. Good timing for teams moving off Ingress NGINX. (AWS)
  • Cloud Run jobs with GPUs for up to 12 hours (preview, 30 October). Long fine-tuning and batch-inference runs can now go on Google’s serverless containers. (release notes)
  • Volcano v1.16 (28 October), the CNCF scheduler for batch and AI jobs on Kubernetes. Teams can now build their own queue hierarchies and quotas, and a new fair-share plugin takes past usage into account. (CNCF blog)
  • Docker relaunched its partner program (28 October) around “Docker AI Governance”: one sandbox standard, one policy model and one audit trail for agent stacks, in three tiers. (press release)

Funding and deals

  • Upwind raised $400M in a Series C at a $3.8B valuation (28 October), led by Bessemer Venture Partners with Greylock and Craft Ventures. Upwind does runtime-first cloud security: it watches running workloads and stops attacks as they happen. TechCrunch reports it turned down an acquisition offer from Datadog first. The week’s biggest deal in container security. (TechCrunch)
  • CrowdStrike is buying Fiddler AI and Dreadnode (3 November). Fiddler monitors AI agents and explains their decisions; Dreadnode builds offensive AI security testing. The Wall Street Journal put the price at about $495M combined; CrowdStrike hasn’t disclosed terms. Not containers, but the agents those containers run. (SecurityWeek)
  • Hyperbolic raised a $30M Series A-1 (27 October, a day before our window), led by Walden Catalyst with Dell Technologies Capital, General Catalyst and Vista Equity Partners. It builds software that pools GPU capacity across smaller clouds into one market. (Hyperbolic)

Security

Docker Desktop for Windows: a Critical container escape (3 November)

CVE-2026-112917, rated Critical. On x86-64 Windows with the WSL 2 backend, an unprivileged Linux container can get around the seccomp filter using 32-bit socketcall and reach services facing the host, and the signed-in user’s Windows files. It’s fully fixed only with Docker Desktop 4.98.0 and WSL 3.0.3 together; 4.98.0 on an older WSL is still affected. LinuxKit-based backends are not affected. The same release fixes CVE-2026-98432, a use-after-free in the kernel’s IPv4 TCP code. (GitHub advisory, release notes)

Docker Engine 29.9.3: four fixes, two for Swarm (3 November)

  • CVE-2026-115539 (SwarmKit): an attacker holding one valid worker node’s certificate and key can obtain a manager certificate shortly after a leader change. One stolen worker key can become control of the whole cluster.
  • CVE-2026-115538: on hosts running firewalld, Swarm overlay networks lose their encryption and anti-spoofing rules when firewalld flushes Docker’s iptables rules. If firewalld has reloaded, check whether your overlay traffic is still encrypted.
  • CVE-2026-116587: crafted RSA keys cause heavy CPU use.
  • CVE-2026-116591: crafted zstd data crashes the daemon.

No CVSS scores were published, and the advisory pages weren’t up at the time of writing. (release)

BuildKit: two Medium bugs (3 November)

  • CVE-2026-121520: a malicious build client can set trusted.* or security.* extended attributes on files outside BuildKit’s state directory, which could give a program on the host more privileges. Affects v0.34.0 and earlier; fixed in v0.34.1. It matters if your build service accepts builds from people you don’t trust. (advisory)
  • CVE-2026-121522: a crafted build definition crashes the daemon through the Git source resolver. Affects v0.26.0–v0.34.1; fixed in v0.34.2, which Docker Engine 29.9.3 includes. (advisory)

Docker Sandboxes: two ways out to the host (3–4 November)

Both are High, and both matter if you run AI agents in Docker Sandboxes:

  • CVE-2026-121614: a sandbox in direct mode with the repository mounted read-write can plant a Git core.fsmonitor setting. That program then runs on the host, outside the microVM, on a later clone-mode fetch or sbx kit push. Affects 0.31.0 up to 0.50.0; fixed in 0.50.0. (advisory)
  • CVE-2026-103916: a malicious sandbox can swap a file in the workspace for a symlink, so a later sbx cp reads or writes host files outside the workspace. Fixed in v0.51.0. (advisory)

A sandbox is only as strong as the paths it shares with the host. Our post on container isolation covers why.

Rancher Manager: three CVEs (29 October)

  • CVE-2026-104623 (Medium): any authenticated user, even with only the default user role, can get a shell pod in cattle-system on the management cluster.
  • CVE-2026-88811 (High): the meta proxy leaks the caller’s Rancher credentials to third-party hosts.
  • CVE-2026-88809 (High): the meta proxy’s allowlist can be bypassed, which allows requests to internal services (SSRF).

Rancher’s management cluster controls every downstream cluster, which makes this the biggest potential blast radius of the week. Fixed in 2.15.3, 2.14.7, 2.13.11, 2.12.15 and 2.11.19. Consider rotating tokens for users who provisioned clusters with cloud credentials. (advisory)

Harbor: one request takes the registry down (28 October)

A single unauthenticated PUT /api/v2.0/users crashes Harbor core, and repeating it keeps the API, the UI and registry authentication down (CVSS 7.5, no CVE yet). Affects 2.13.0–2.13.6, 2.14.0–2.14.5 and 2.15.0–2.15.2. Fixed in 2.15.3 and 2.14.6; the advisory lists no fix for 2.13. Blocking that path at your proxy is a safe workaround, because it isn’t a real endpoint. (advisory)

Also patched this week

  • Argo CD Image Updater, CVE-2026-121621 (CVSS 8.8): a malicious proxy setting on an SSH Git repository runs commands in the Image Updater process, where its credentials are. The fix is merged but not yet in a release; the latest is v1.4.0. (advisory)
  • Cilium (CVSS 6.8, no CVE yet): anyone who can write a CiliumNetworkPolicy can make cilium-agent read a local file and put it in an HTTP header. Fixed in v1.20.2, v1.19.8 and v1.18.14. (advisory)
  • Traefik: its Kubernetes Ingress NGINX provider silently drops the mTLS required by auth-tls-secret when another Ingress shares the host (CVE-2026-119572, CVSS 8.7, fixed in 3.7.15). A separate bug lets unauthenticated NTLM or Negotiate headers exhaust memory and file handles (CVSS 7.5, fixed in v3.7.17 and v2.11.61). (advisory, advisory)
  • @sigstore/oci, CVE-2026-118763 (CVSS 7.4): the registry Authorization header is sent on to a blob-upload location on another host, which can leak registry credentials. (advisory)

Quiet this week

No new CVEs for runc, containerd, CRI-O, crun, gVisor, Kata, Podman, Buildah, Helm, or Kubernetes itself, and none of this week’s container CVEs is in CISA’s list of exploited bugs.

You can search every container CVE, updated every hour, on our CVE search.

Releases

  • Kubernetes v1.37.2, v1.36.6, v1.35.10 and v1.34.13 (28 October). Built with Go 1.26.10. The API server now accepts up to 16,384 request header values, so impersonated users with many groups no longer get HTTP 431. No security fixes. (changelog)
  • Docker Engine 29.9.3 (3 November). The fixes above, BuildKit v0.34.2, and a fix for the daemon hanging under load. (release)
  • Docker Desktop 4.98.0 (3 November). On Mac, the privileged com.docker.vmnetd helper is gone and is removed automatically. On Windows, docker and docker compose now work from WSL 2 distros when Docker VMM is the engine. (release notes)
  • Docker Compose v5.7.0 (2 November). up now creates and starts services as one plan, from a single snapshot of the daemon’s state. (release)
  • Argo CD v3.6.0 (3 November), with progressive-sync metrics and conditions for ApplicationSets. (release)
  • Rancher 2.15.3, 2.14.7, 2.13.11, 2.12.15 and 2.11.19 (29 October). The security fixes above. (releases)
  • Maintenance releases: CRI-O v1.37.3, v1.36.8 and v1.35.11, and Traefik v3.7.17 and v2.11.61. Release candidates: Istio 1.32.0-rc.1, Cilium v1.21.0-pre.4 and Harbor v2.16.0-rc1.

No new runc, containerd, Podman or Helm releases this week.

Elsewhere

  • Malicious AI models go after GPU hosts (29 October). Pluto Security found 31 Hugging Face repositories that abuse trust_remote_code to install crypto miners and reverse shells on Xinference and GPUStack hosts, with more than 32,000 downloads. After the report, the operator published a model whose script tries to break out of its container and take over the host. If you serve models in containers, don’t enable trust_remote_code for models you haven’t reviewed. (BleepingComputer, Pluto Security)
  • An exploited Linux kernel bug (28 October). CISA added CVE-2026-46300 to its catalog of exploited vulnerabilities. Attackers chain it with two PHP bugs to run commands as root. It isn’t a container bug, but every container on a host shares that host’s kernel, so patch your nodes. (CISA KEV)
  • Docker maps its tools to the Blueprint Alliance’s agent controls (2 November). Docker is a founding member of the alliance, a shared architecture for securing AI agents with Okta, AWS, CrowdStrike, Google Cloud, Wiz, Zscaler and others, launched in September. The new post shows where Docker Sandboxes, MCP Gateway and Hardened Images fit the draft Agent Baseline controls. (Docker)
  • Kubernetes AI Conformance moves into SIG Architecture (29 October), out of its working group. (Kubernetes blog)

Coming up

  • KubeCon + CloudNativeCon North America, Salt Lake City, 9–12 November. Expect most CNCF announcements next week. (CNCF)

Missed something? Tell us and it goes in next week’s issue.