Medium
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
Type: advisorySources: OSV
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-76061
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:19 UTC · Revision 1
Source evidence
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
core-osv · Original sourcePublished 6 Oct 2026, 19:24 UTC
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
osv:CVE-2026-76061
Complete source record
{
"id": "799efaad8282679b041a3d365c62ec23d0e111646012e8916ab596bd1b752153",
"url": "https://osv.dev/vulnerability/CVE-2026-76061",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass",
"summary": "A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.",
"evidence": "osv:CVE-2026-76061",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-76061",
"aliases": [
"CVE-2026-76061"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cri-o/cri-o",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "dcc865df61cc1b8883461ba36ee1e87849bf1d55"
},
{
"introduced": "92c18a2e2673764cd10f89b1a5061e2b26f44209"
},
{
"fixed": "c79f8aef829ec309415c1896a8ceb1be85e17d1e"
},
{
"introduced": "d1e7bdc854ed4846a7f15c5e0c17e0140a1d817b"
},
{
"fixed": "9209fd24af47bd91ffa36f0d47edb7729783be00"
},
{
"introduced": "c2aaa4071694be6d6a70a581d8e10c6e2e5ea05a"
},
{
"fixed": "8d7d70ec4165a394e791f0e6fda74428b1c50f86"
},
{
"fixed": "01f90366dc8c8db0df32b4aae7fd067c1eddbb70"
},
{
"fixed": "6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40"
},
{
"fixed": "d6f58973acfcae93ecc039e0297fbe5f2548b46b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.34.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "1.35.0"
},
{
"fixed": "1.35.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "1.36.0"
},
{
"fixed": "1.36.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "1.37.0"
},
{
"fixed": "1.37.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "01f90366dc8c8db0df32b4aae7fd067c1eddbb70"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d6f58973acfcae93ecc039e0297fbe5f2548b46b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.37.0",
"v1.35.8",
"v1.34.13",
"v1.36.5",
"v1.35.7",
"v1.34.12",
"v1.36.4",
"v1.34.11",
"v1.36.3",
"v1.35.6",
"v1.35.5",
"v1.34.10",
"v1.36.2",
"v1.34.9",
"v1.35.4",
"v1.36.1",
"v1.35.3",
"v1.36.0",
"v1.34.8",
"v1.34.7",
"v1.35.2",
"v1.34.6",
"v1.35.1",
"v1.34.5",
"v1.35.0",
"v1.34.4",
"v1.34.3",
"v1.34.2",
"v1.34.1",
"v1.34.0",
"v1.33.0",
"v1.32.0",
"v1.31.0",
"v1.30.0",
"v1.29.0",
"v1.27.0",
"v1.26.0",
"v1.25.0",
"v1.24.0",
"v1.23.0",
"v1.22.0",
"v1.21.0",
"v1.18.0-rc1",
"v1.9.0-beta.2",
"v1.9.0-beta.1",
"v1.0.0-rc1",
"v1.0.0-beta.0",
"v1.0.0-alpha.0",
"v0.3",
"v0.2",
"v0.1",
"v0.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76061.json"
}
}
],
"modified": "2026-10-28T02:30:38.005741029Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://access.redhat.com/security/cve/CVE-2026-76061",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76061.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-76061",
"https://bugzilla.redhat.com/show_bug.cgi?id=2520330",
"https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70",
"https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40",
"https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b",
"https://github.com/cri-o/cri-o"
],
"provider_metadata": {
"cwe_ids": [
"CWE-59"
],
"cna_assigner": "redhat",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76061.json"
}
},
"related_cves": [
{
"value": "CVE-2026-76061",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505271,
"published_at": "2026-10-06T19:24:30.457+00:00"
}