CVE-2026-76061
- Source
- https://cve.org/CVERecord?id=CVE-2026-76061
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76061.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-76061
- Downstream
- Published
- 2026-10-06T19:24:30Z
- Modified
- 2026-10-08T02:52:00Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
- Summary
- Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
- Details
-
A flaw was found in CRI-O's
bind_mount_prefixhandling. When configured with a non-emptybind_mount_prefix, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system. - Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-59" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76061.json" }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-76061
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76061.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-76061
- https://bugzilla.redhat.com/show_bug.cgi?id=2520330
- https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70
- https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40
- https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b
- https://github.com/cri-o/cri-o
Affected packages
Git / github.com/cri-o/cri-o
Affected ranges
- Type
- GIT
- Repo
- https://github.com/cri-o/cri-o
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.34.14" }, { "introduced": "1.35.0" }, { "fixed": "1.35.9" }, { "introduced": "1.36.0" }, { "fixed": "1.36.6" }, { "introduced": "1.37.0" }, { "fixed": "1.37.1" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v0.*
v0.0.0
v0.1
v0.2
v0.3
v1.*
v1.0.0-alpha.0
v1.0.0-beta.0
v1.0.0-rc1
v1.18.0-rc1
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.29.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.34.1
v1.34.10
v1.34.11
v1.34.12
v1.34.13
v1.34.2
v1.34.3
v1.34.4
v1.34.5
v1.34.6
v1.34.7
v1.34.8
v1.34.9
v1.35.0
v1.35.1
v1.35.2
v1.35.3
v1.35.4
v1.35.5
v1.35.6
v1.35.7
v1.35.8
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.36.4
v1.36.5
v1.37.0
v1.9.0-beta.1
v1.9.0-beta.2