CVE-2026-76061

5.5 Moyenne

Publiée le 06/10/2026 à 22:17 · Modifiée le 09/10/2026 à 04:17 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.

Traduire en français

Produits concernés

Red Hat OpenShift Container Platform 4

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.5 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-59

Références

https://access.redhat.com/security/cve/CVE-2026-76061
https://bugzilla.redhat.com/show_bug.cgi?id=2520330
https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70
https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40
https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories