CVE-2026-76061
5.5
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Summary
A flaw was found in CRI-O's bind_mount_prefix handling. When configured with a non-empty bind_mount_prefix, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
0 < 1.34.14 | affected | ||
1.35.0 < 1.35.9 | affected | ||
1.36.0 < 1.36.6 | affected | ||
1.37.0 < 1.37.1 | affected |
Weaknesses
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
References
- https://access.redhat.com/security/cve/CVE-2026-76061
- https://bugzilla.redhat.com/show_bug.cgi?id=2520330
- https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70
- https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40
- https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.