CVE Intelligence
Analysis AI-assisted

CVE-2026-25996: Inspektor Gadget unsanitized ANSI escape sequences in columns output mode

Inspektor Gadget renders string fields from eBPF events in columns output mode without removing control characters or ANSI escape sequences. A forged event payload from an observed container could inject escape sequences into the terminal of an operator running ig. The record lists affected versions before 0.49.1 and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Inspektor Gadget is a set of eBPF-based tools for data collection and system inspection on Kubernetes clusters and Linux hosts. According to the record, string fields from eBPF events are rendered to the terminal in columns output mode without sanitizing control characters or ANSI escape sequences. This mode is the default when running ig run interactively.

Impact

  • A maliciously forged event payload, partially or completely, coming from an observed container could inject escape sequences into the terminal of an ig operator.
  • The record states that the effects may vary, but it does not describe specific effects.
  • The NVD base score is 9.8 and the GitHub CNA score is 6.9.

Affected products and versions

  • Inspektor-gadget Inspektor-gadget: versions before 0.49.1.
  • Linuxfoundation Inspektor Gadget: versions before 0.49.1.

The record lists a patch commit (d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2) and identifies 0.49.1 as the allowed version for the fix. The exact boundary should be confirmed against the project's advisory.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record marks exploitation as proof-of-concept, which indicates maturity and is not evidence of active attacks.

Remediation and mitigation

  • Upgrade Inspektor Gadget to version 0.49.1 or later.
  • Until the upgrade is applied, avoid running ig in interactive columns mode against workloads whose output may be untrusted.
  • Restrict who can view operator terminals and review logs produced by sessions that observe untrusted containers.

Detection guidance

  • Review terminal sessions and captured output for unexpected control sequences or display anomalies when observing untrusted workloads.
  • Check which Inspektor Gadget versions are deployed on Kubernetes nodes and Linux hosts and compare them against the affected range.

Limitations of the available information

The record does not describe the specific effects of the injected sequences, provides no CWE name for CWE-150, and gives no proof-of-concept details. The EPSS data is a probability estimate and does not confirm exploitation.

Frequently asked questions

What is the vulnerability in CVE-2026-25996?

String fields from eBPF events are shown in columns output mode without removing control characters or ANSI escape sequences, so forged event data could affect an operator's terminal.

Which versions are affected?

The record lists affected versions before 0.49.1 for both listed products.

Is this vulnerability actively exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Upgrade Inspektor Gadget to 0.49.1 or later and limit interactive columns-mode use when observing untrusted workloads.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.