Privilege Escalation in insights-runtime-extractor via Improper Capability Dropping

CVE-2026-104795 describes a critical privilege escalation vulnerability within the insights-runtime-extractor DaemonSet. The extractor, which runs with hostPID: true and elevated privileges to perform runtime fingerprinting of container processes, fails to perform a complete privilege drop when interacting with untrusted container namespaces. Specifically, the Rust-based coordinator uses seteuid() to change the effective user ID while retaining the real UID and saved-set-UID as 0, and fails to drop permitted capabilities.

When the extractor identifies a process binary matching a fingerprinting pattern (e.g., node, python, or java), it invokes a Go-based utility that executes the binary from the container's namespace to retrieve version information. Because the extractor is still effectively root in the host user namespace and retains elevated capabilities, the malicious binary can restore full root access, inherit an orphaned directory file descriptor pointing to the extractor's root filesystem, and access the host CRI-O socket. This results in full node compromise for any tenant capable of scheduling a pod on the affected cluster.

Attack Chain

1. An attacker schedules a malicious pod with an unprivileged service account on a node running the insights-runtime-extractor DaemonSet.
2. The attacker defines the pod's main binary to match common runtime names targeted by the extractor (e.g., node, python).
3. The insights-runtime-extractor coordinator detects the pod process and forks a child process to perform fingerprinting.
4. The extractor joins the target pod's PID and mount namespaces but fails to drop root privileges (ruid=0) or permitted capabilities.
5. The extractor calls exec.Command on the malicious binary located within the pod's mount namespace.
6. The malicious binary executes with root privileges in the host user namespace.
7. The binary calls setuid(0) to escalate privileges and uses the inherited file descriptor to access /crio.sock.
8. The attacker interacts with the CRI-O socket to achieve full node compromise and container breakout.

Impact

Successful exploitation leads to full compromise of the Kubernetes node hosting the vulnerable insights-runtime-extractor DaemonSet. An attacker can transition from an unprivileged pod to host-level root, enabling credential theft, lateral movement within the cluster, and potential access to persistent volumes or sensitive secrets stored on the node.

Recommendation

1. Audit existing insights-runtime-extractor deployments for the hostPID: true security context and restrict access to clusters where untrusted tenants are present.
2. Implement Kubernetes Admission Controllers to prevent the deployment of pods containing binaries that match the vulnerable fingerprinting patterns until a vendor patch is applied.
3. Monitor for unusual exec calls originating from the insights-runtime-extractor container process targeting binary paths within /proc/<pid>/root.
4. Apply patches provided by the vendor for the insights-runtime-extractor once available to ensure setresuid() and proper capability dropping are implemented.