Leaky Vessels: runC and BuildKit container escape vulnerabilities - everything you need to know

Wiz Research details “Leaky Vessels,” four container escape vulnerabilities—CVE-2024-21626 (runC) and CVE-2024-23651/23652/23653 (BuildKit)—that can enable host filesystem access and privileged host compromise via malicious Dockerfiles, BuildKit frontends, or runc exec. The advisory lists affected versions, available patches (runC v1.1.12; BuildKit v0.12.5; Moby/Docker Engine v25.0.2; Docker Desktop v4.27.1), prioritized remediation guidance for cloud/container operators, and detection/prevention options including the Wiz Runtime Sensor and Threat Center queries.