On November 5, 2025, the Google Cloud Security Team disclosed critical vulnerabilities affecting runc (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881). These flaws presented a risk of container breakouts and potential root privilege escalation within Cloud Run worker pools.
Impact and Resolution
If exploited, these vulnerabilities could allow a malicious actor to gain unauthorized access to the underlying execution environment. In response, Google Cloud proactively notified customers and implemented a mandatory security update moving Cloud Run jobs to Linux user namespaces. This change effectively mitigates the risk by removing true root access for containers, ensuring a more secure sandboxed environment.