CVE-2026-76061: medium-severity vulnerability in cri-o
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.2%
exploitation probability
0.2%top 87% of all CVEs
observed exploitation
nono source reports it
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Related CVEs — cri-o
In the same product, most dangerous first.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.1%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 40.6%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.7%CVE-2026-4480CRITICALSamba: samba: remote code execution in printing subsystem via unescaped job descriptionEPSS 13.9%CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.8%
References
https://access.redhat.com/security/cve/CVE-2026-76061https://bugzilla.redhat.com/show_bug.cgi?id=2520330https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b