CVE-2026-76061: fallo de gravedad media en cri-o
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.2%
probabilidad de explotación
0.2%top 87% de las CVE
explotación observada
noninguna fuente lo reporta
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
CVEs relacionadas — cri-o
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.1%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 40.6%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.7%CVE-2026-4480CRITICALSamba: samba: remote code execution in printing subsystem via unescaped job descriptionEPSS 13.9%CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.8%
Referencias
https://access.redhat.com/security/cve/CVE-2026-76061https://bugzilla.redhat.com/show_bug.cgi?id=2520330https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b