CVE-2026-76061
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
MEDIUM 5.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Awaiting Analysis
Description
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
Weaknesses (CWE)
- CWE-59 — Improper Link Resolution Before File Access
References
- https://access.redhat.com/security/cve/CVE-2026-76061
- https://bugzilla.redhat.com/show_bug.cgi?id=2520330
- https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70
- https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40
- https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L | redhat |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L | NVD · secalert@redhat.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-93915
- GCVE · GCVE-0-2026-76061
Affected products
| Product | Versions |
|---|---|
| cri-o | affected 0 < 1.34.14 ; affected 1.35.0 < 1.35.9 ; affected 1.36.0 < 1.36.6 ; affected 1.37.0 < 1.37.1 |
| Red Hat · Red Hat OpenShift Container Platform 4 | |
| Red Hat · Red Hat OpenShift Container Platform 4 | |
| Red Hat · Red Hat OpenShift Container Platform 4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |