Local Privilege Escalation in NimbusStack Orchestrator

A local privilege escalation vulnerability in the NimbusStack container orchestration platform allows a process running inside a container to escape the container and gain elevated privileges on the host system.

The vulnerability exists in the container runtime's handling of namespace isolation. Under specific conditions involving nested namespaces and capability grants, a process inside a container can traverse the namespace boundary and execute code with elevated privileges on the host.

Upgrade NimbusStack to version 2.7 or later. Apply the provided security advisory patch for versions 2.0–2.6.