CVE-2021-3762: Red Hat Clair

Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days.

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.

Affected products

• Red Hat Clair: from 0.4.6, before 0.4.8 (fixed in 0.4.8); from 0.5.3, before 0.5.5 (fixed in 0.5.5)
• Red Hat Quay: version 3.5.6 only

Published 2022-03-03. Last modified 2026-06-17.