The Great Escape: A Blast Radius Analysis of Container Attacks

This report analyzes 105 real-world container escape incidents observed in 2021, finding that 36% of victim hosts had multiple severe vulnerabilities/misconfigurations and 70% had opportunities for credential theft or lateral movement; remediation was inconsistent, with half of hosts fully fixed weeks later. The analysis outlines the blast radius of such attacks—exposure of remote services, cloud metadata, unencrypted HTTP, databases and big-data services—and illustrates impact with a case study involving exposed websites, MySQL/Redis instances and a critical Apache ZooKeeper vulnerability in a large cluster, concluding with lessons and mitigation guidance.