Description
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
cri-o
Default version status: unaffected
0 to < 1.34.14affected1.35.0 to < 1.35.9affected1.36.0 to < 1.36.6affected1.37.0 to < 1.37.1affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
References
- https://access.redhat.com/security/cve/CVE-2026-76061 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2520330 ↗
- https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70 ↗
- https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40 ↗
- https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b ↗