How severe is CVE-2026-25996?

CVE-2026-25996 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-25996 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25996?

CVE-2026-25996 affects Linuxfoundation Inspektor Gadget. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25996?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-25996 have an EU (EUVD) identifier?

Yes. CVE-2026-25996 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6695.

When was CVE-2026-25996 published?

CVE-2026-25996 was published on 2026-02-12 and last updated on 2026-06-17.

CVE-2026-25996

CVE-2026-25996 is a critical-severity vulnerability in Linuxfoundation Inspektor Gadget with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-150.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 6.9
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-6695
Weakness: CWE-150
Affected product: Linuxfoundation Inspektor Gadget
Published: 2026-02-12
Last modified: 2026-06-17

Description

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

Frequently asked questions

What is CVE-2026-25996?: Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.
How severe is CVE-2026-25996?: CVE-2026-25996 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-25996 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25996?: CVE-2026-25996 affects Linuxfoundation Inspektor Gadget. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25996?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-25996 have an EU (EUVD) identifier?: Yes. CVE-2026-25996 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6695.
When was CVE-2026-25996 published?: CVE-2026-25996 was published on 2026-02-12 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:linuxfoundation:inspektor_gadget:*:*:*:*:*:*:*:*

More vulnerabilities in Linuxfoundation Inspektor Gadget

CVE-2026-24905 — High (CVSS 7.8): Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and…
CVE-2026-31890 — Medium (CVSS 5.5): Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and…

All CVEs affecting Linuxfoundation Inspektor Gadget →

Other CWE-150 vulnerabilities

CVE-2022-30123 — Critical (CVSS 10.0): A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell…
CVE-2020-6932 — Critical (CVSS 10.0): An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX…
CVE-2025-47284 — Critical (CVSS 9.9): Gardener implements the automated management and operation of Kubernetes clusters as a service. A security…
CVE-2023-26055 — Critical (CVSS 9.9): XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version…
CVE-2025-25286 — Critical (CVSS 9.8): Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior…
CVE-2023-3265 — Critical (CVSS 9.8): An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the…

Browse all CWE-150 vulnerabilities →