← CVE Intelligence

CVE-2026-92574

Cri-o: cri-o checkpoint restore bypasses destination security context PUBLISHED

Description (CNA)

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 1.34.0 before 1.34.14; affected 1.35.0 before 1.35.9; affected 1.36.0 before 1.36.6
Red Hat / Confidential Compute Attestationunaffected
Red Hat / Red Hat Enterprise Linux 8unaffected
Red Hat / Red Hat Enterprise Linux 8unaffected
Red Hat / Red Hat Enterprise Linux 9unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4affected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected

CWE

CWE-250

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.