CVE-2025-65105

mediumpriority · track · 21EPSS 0.002 · 14 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.23% (14th) EPSS

CVSS 5.3 · medium

Is it mine?

3 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedapptainer-0:1.4.5-150600.4.12.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-150600.4.12.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-150600.4.12.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-150600.4.12.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-150600.4.12.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-150600.4.12.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-leap-0:1.4.5-150600.4.12.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_6-0:1.4.5-150600.4.12.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_6-0:1.4.5-150600.4.12.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_7-0:1.4.5-150600.4.12.1.noarch as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibsquashfuse0-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-devel-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-devel-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-devel-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-devel-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedsquashfuse-tools-0:0.5.0-150600.3.2.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-leap-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-leap-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-leap-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-leap-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_7-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_7-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_7-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle15_7-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle16-0:1.4.5-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle16-0:1.4.5-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle16-0:1.4.5-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedapptainer-sle16-0:1.4.5-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.14.5mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.14.5mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · security-advisories@github.comexploitability 1 · impact 3.4

v3.14.5mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-61USCWE-61USCWE-706USCWE-706US

affected products (3)

Products and version ranges known to be affected.

apptainer apptainer≤ < 1.4.5enisa_euvdEU
lfprojects apptainer< 1.4.5nvdUScpe:2.3:a:lfprojects:apptainer:*:*:*:*:*:*:*:*
Go github.com/apptainer/apptainer< 1.4.5osvUSpkg:golang/github.com/apptainer/apptainer

advisories (4)

Vendor and ecosystem advisories describing this.

SUSE-SU-2026:0439-1Security update for apptainer2026-02-11csaf · suse_csafDE
Security update for apptainer
openSUSE-SU-2026:10013-1apptainer-1.4.5-1.1 on GA media2026-01-07csaf · suse_csafDE
apptainer-1.4.5-1.1 on GA media
GHSA-j3rw-fx6g-q46jApptainer ineffectively applies selinux and apparmor --security options2025-12-02ghsa · osvUS
### Impact In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used `--security` option, in particular the forms `--security=apparmor:<profile>` and `--security=selinux:<label>` which otherwise put restrictions on operations that containers can do. The `--security` option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. In addition, a bug in the detection of selinux support in Apptainer's suid mode means that `--security selinux:<label>` flags may not be applied, even in the absence of an attack. In that case a warning message is emitted indicating that selinux is unavailable, but the warning may be may be overlooked, mis-interpreted, or not seen when apptainer is run from a script or other tool. Failure to apply requested restrictions should result in a fatal error rather than just a warning message. ### Patches Ineffective write of selinux process labels is addressed via an update to the containers/selinux dependency in https://github.com/apptainer/apptainer/pull/3226. That update brings in the upstream fix for https://github.com/advisories/GHSA-cgrx-mc8f-2prm which was for a different but related vulnerability. Ineffective write of apparmor process profiles is addressed in commit 4313b42. Failure to detect apparmor / selinux support, when --security flags are provided, is made an error rather than a warning in commit 82f1790. ### Workarounds There are no known workarounds, other than to define system-wide apparmor / selinux policy for Apptainer itself. This would apply to all containers, not just those run with the `--security` flags, and could impact the operation of Apptainer itself. ### References Thanks to Sylabs for finding this issue, fixing it in https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 which was easy to import into Apptainer, and disclosing it early to the Apptainer project for a coordinated release. The related upstream runc disclosure which inspired the investigation is https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm.
GO-2025-4176Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer2025-12-08vendor · osvUS
Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd suse_csaf NVD CVE.org MITRE

published 2025-12-02modified 2026-10-18

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan