Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
CVE-2026-76061
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-76061
Red Hat OpenShift Container Platform 4
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift Container Platform 4
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift Container Platform 4
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.34.14",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.35.0",
"lessThan": "1.35.9",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.36.0",
"lessThan": "1.36.6",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.37.0",
"lessThan": "1.37.1",
"versionType": "semver"
}
],
"packageName": "cri-o",
"collectionURL": "https://github.com/cri-o/cri-o",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"packageName": "cri-o",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"packageName": "openshift/ose-rhel-coreos-8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"packageName": "openshift/ose-rhel-coreos-9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-76061
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #16155 · Revision 1
- Added to Heist Feed
- Publisher date