SearchSubscribe

TRA-2026-35

Container escape through writable host socket in serverless runtime

The function sandbox mounts the host runtime socket read-write, letting tenant code start privileged containers on the shared node.

  • Patched
  • Cloud

CVSS 3.1 base score

8.8high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Vendor
Northwind Cloud
Product
Northwind Functions
CVE
  • CVE-2026-33980
Disclosure
89 days
Researchers
Rémi Laurent, Daniel Okafor

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Northwind FunctionsRuntime images before 2026-07-02Runtime 2026-07-02

Read the research

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

The function sandbox mounts the host runtime socket read-write, letting tenant code start privileged containers on the shared node.

Proof of concept

Tenable has shared a proof of concept with Northwind Cloud. It is not published here, to give operators time to apply the fix.

Solution

Northwind Cloud rolled out patched runtime images. Redeploy functions pinned to older runtime versions.

Disclosure timeline

  1. Tenable reports the issue to Northwind Cloud

  2. TRA-2026-35 published

89 days from report to publication, against a 90-day policy.How we disclose