CVE-2026-47833: bpm-release Symlink Privilege Escalation & Container-to-Host Breach

Technical summary

The vulnerability exists in setupBpmLogs, which follows symlinks when opening and changing ownership of bpm.log without validating the target. A malicious process running inside a bpm container can create a symlink at the expected log path pointing to a host filesystem object (e.g., /etc/shadow accessible via bind mount), causing a chown operation to run with elevated privileges. The attacker then gains read access to the symlink target through the container's read-only bind mount of /etc, exposing password hashes. CWE-59 (Improper Link Resolution Before File Access) directly describes this flaw.

Business impact

This vulnerability enables confidentiality breach of credential material on the host system. An attacker with container compromise can extract password hashes for all users, facilitating offline cracking and lateral movement. The issue affects every bpm-managed job, meaning any workload running under bpm is a potential pivot point. For enterprises relying on bpm for containerized process management, this creates a critical supply-chain-like risk if any tenant or workload is compromised.

Affected systems

All versions of bpm-release prior to v1.4.30 are affected. Any deployment running bpm for container orchestration or job management is vulnerable if it permits untrusted or potentially compromised processes to run inside bpm-managed containers. The flaw is particularly dangerous in multi-tenant or shared-host environments.

Exploitability

Exploitation requires a compromised or malicious process already running inside a bpm container (local privilege escalation with container access). An attacker cannot directly exploit this from outside the container boundary. However, once inside a container, exploitation is trivial—creating a symlink and triggering log setup requires no special privileges or user interaction. The low complexity and local attack vector mean the risk is substantial in environments where container workload integrity cannot be fully assured.

Remediation

Upgrade bpm-release to v1.4.30 or later immediately. This patch version addresses the symlink-following issue by validating link targets before performing chown operations. No configuration workarounds are available; patching is the only mitigation. Organizations should verify patch application across all nodes and re-baseline container images to ensure the fixed version is in use.

Patch guidance

Deploy bpm-release v1.4.30 or newer across all systems running bpm. Verify the patch by checking the bpm-release version in your deployment manifest or release metadata. Test in a non-production environment first to confirm compatibility with your job definitions and workloads. Once patched, restart affected jobs to ensure the new binary is in use. Check vendor advisory documentation for any breaking changes or migration notes between your current version and 1.4.30.

Detection guidance

Monitor for symlink creation within bpm container filesystems, particularly targeting /var/log or the expected bpm.log path. Audit chown operations on sensitive host files (especially /etc/shadow) triggered by vcap user or bpm processes. Review container runtime logs for unexpected file ownership changes. Implement filesystem integrity monitoring on /etc/shadow and similar critical host files to alert on unauthorized access or permission changes. Check for any suspicious log entries in bpm logs themselves that may indicate failed exploitation attempts.

Why prioritize this

Although rated MEDIUM (CVSS 6.1), this vulnerability should receive elevated priority because it bridges container-to-host isolation, exposes password hashes, and affects all bpm-managed workloads universally. The low exploitation complexity and universal presence in vulnerable deployments compound the risk. Password compromise is a stepping stone to broader infrastructure attack.

Risk score, explained

CVSS 3.1 score of 6.1 (MEDIUM) reflects local attack vector and low impact to integrity, but the confidence interval for confidentiality is high. The score correctly penalizes the requirement for local container presence (PR:L) while recognizing the serious nature of credential exposure. The MEDIUM rating may understate business risk in environments where container compromise is plausible; assess contextually based on workload trust assumptions.

Frequently asked questions