GCP News - 2026-05-14

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

GKE Standard clusters with Ubuntu nodes are impacted. GKE Standard clusters with Container-Optimized OS nodes are not impacted. GKE Autopilot is not impacted.

Clusters using GKE Sandbox aren't impacted.

What should I do?

Upstream kernel patches have only recently been released. Those patches are being built into GKE releases and this bulletin will be updated when they are available. In the interim, partial mitigations are available below. Containers do not provide a robust security boundary, as container breakout vulnerabilities pose a significant risk. For secure workload isolation, we recommend using GKE Sandbox.

If possible, migrate your workloads to run as non-root. If your container needs to be root, consider setting the pod.spec.securityContext.seccompProfile.type to RuntimeDefault for all workloads in your cluster. As an added security measure, we also recommend setting the pod.spec.containers[*].securityContext.allowPrivilegeEscalation to false.

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: mycontainer
    image: ubuntu
    securityContext:
      allowPrivilegeEscalation: false

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?

A container breakout vulnerability CVE-2026-46300 has been found in the Linux kernel, known as Fragnesia. It allows an unprivileged local attacker to escalate to root on the host.

What should I do?