Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-92574

Cri-o: cri-o checkpoint restore bypasses destination security context

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

cri-o

Default version status: unaffected

  • 1.34.0 to < 1.34.14affected
  • 1.35.0 to < 1.35.9affected
  • 1.36.0 to < 1.36.6affected

Red Hat Confidential Compute Attestation

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: unaffected

Red Hat Red Hat OpenShift Container Platform 5

Default version status: unaffected

References