What’s Vulnerable › Vulnerabilities

CVE-2026-76061: Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-09
• Weakness: CWE-59

Description

A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-76061
• https://bugzilla.redhat.com/show_bug.cgi?id=2520330
• https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70
• https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40
• https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b

Get alerted when CVE-2026-76061 or the next vulnerability affects your stack