CVE-2026-32677 is a path traversal flaw in Intel's gaudi-container-runtime before version 1.24.0. The record scores it 7.3 (High), while Intel rates it 5.4 (Medium). An authenticated local user could escalate privilege. Intel advises updating to 1.24.0 or later.
What's affected
Intel's advisory INTEL-SA-01489 lists all versions of Gaudi Container Runtime before 1.24.0 as affected, and the fix is 1.24.0 or later. Updates are available from the HabanaAI gaudi-container-runtime repository on GitHub.
Source conflict to note: the CVE record gives 7.3 (High) with CVSS 3.1. Intel gives 5.4 (Medium) with CVSS 4.0, and says exploitation needs local access, a low privilege authenticated user and passive user interaction. Both are reported here.
Weakness class: CWE-22, path traversal.
How to check if you're exposed
Find the container runtime package on your Gaudi hosts and read its version using your package manager, for example by listing installed packages and filtering for gaudi or habana in the name. Compare the version with 1.24.0. If you built the runtime from source, check the tag you built.
Also list which users can start containers on the hosts. A runtime sits between container configuration and the host file system, so anyone who can launch containers is a possible starting point for this flaw.
What to do now
- Update gaudi-container-runtime to 1.24.0 or later from the HabanaAI repository.
- Rebuild any base images or host images that bake the runtime in, and redeploy them.
- Limit who can launch containers on Gaudi hosts to the people and pipelines that need it.
- Scan your container images and host images for other outdated components, and use the free in-browser dependency scan for any application manifests.
- Review container mount definitions for paths you do not expect.
Why it matters
Path traversal happens when software builds a file path from input and does not stop the path from escaping its intended directory. In a container runtime, the paths in question connect the container's view of the file system to the host's, so an escape can reach files that the container was never meant to see.
Intel rates the impact as high for confidentiality, integrity and availability of the vulnerable system, within the limits of local access and a user who is already authenticated. The KEV flag is false and Intel's advisory does not report exploitation. Runtime bugs are worth fixing even when the severity is Medium, since the runtime is trusted by everything above it.
Try it yourself
Container images and host images carry the runtime you ship. This demo shows how an image scan surfaces outdated components.
Click through it at your own pace, or open it full screen.
Quick check
Is it High or Medium?
The record says 7.3 (High) and Intel says 5.4 (Medium). Both are above, using different CVSS versions.
Does an attacker need to be on the host?
Yes. Intel describes local access with an authenticated low privilege user.
Sources
Last reviewed: 18 October 2026.
