CVE-2026-92574
- Source
- https://cve.org/CVERecord?id=CVE-2026-92574
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92574.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-92574
- Published
- 2026-09-21T09:49:49Z
- Modified
- 2026-10-03T03:30:17Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Cri-o: cri-o checkpoint restore bypasses destination security context
- Details
-
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.
- Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-250" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92574.json" }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-92574
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92574.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-92574
- https://bugzilla.redhat.com/show_bug.cgi?id=2535436
- https://github.com/cri-o/cri-o