AZL-106655

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106655.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-106655
Upstream
Published
2026-10-06T20:17:29Z
Modified
2026-10-07T14:17:12Z
Summary
CVE-2026-76061 affecting package cri-o 1.30.1-1
Details

A flaw was found in CRI-O's bind_mount_prefix handling. When configured with a non-empty bind_mount_prefix, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.

References

Affected packages

Azure Linux:3 / cri-o

Package

Name
cri-o
Purl
pkg:rpm/azure-linux/cri-o

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.30.1-1

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-106655.json"