{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openshift-container-platform--4.17/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-92574"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CRI-O (\u003e= 1.34)","OpenShift Container Platform (\u003e= 4.17)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","kubernetes","container-security","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Red Hat","CRI-O"],"content_html":"\u003cp\u003eCVE-2026-92574 describes a security flaw within the CRI-O container runtime checkpoint/restore mechanism. The vulnerability exists when a user with permissions to create pods utilizes a malicious checkpointed container image to initialize a new pod. During the restoration process, the runtime fails to properly apply the destination pod's intended Kubernetes security context.\u003c/p\u003e\n\u003cp\u003eInstead of enforcing the security settings defined in the new pod specification, the restored process inherits critical security state artifacts from the original checkpoint, including Linux capabilities, user credentials, no_new_privs flags, and seccomp profiles. This effectively allows an attacker to bypass container isolation and execute code with elevated privileges that were intended to be restricted. The vulnerability affects CRI-O version 1.34 and later, as well as Red Hat OpenShift Container Platform version 4.17 and subsequent releases. Impacted environments are those where checkpoint restore functionality is enabled and reachable by users capable of pod creation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits unauthorized privilege escalation within a containerized environment. By bypassing established Kubernetes security contexts, an attacker can gain capabilities or permissions that were explicitly revoked in the destination pod configuration. This compromises container isolation boundaries, potentially allowing for cross-container lateral movement or host-level escalation if the inherited security state provides sufficient privileges. The scope of impact is limited to Kubernetes clusters utilizing affected CRI-O runtimes with checkpoint functionality enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and platform engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit all Kubernetes clusters running CRI-O 1.34+ or OCP 4.17+ where checkpoint/restore functionality is enabled.\u003c/li\u003e\n\u003cli\u003eRestrict pod creation permissions (RBAC) to only trusted identities, as this is a prerequisite for exploitation of CVE-2026-92574.\u003c/li\u003e\n\u003cli\u003eMonitor Kubernetes audit logs for pod creation requests involving unusual image sources or specific checkpoint-related APIs.\u003c/li\u003e\n\u003cli\u003eMonitor for the deployment of pods with security contexts that conflict with the image's source characteristics if such metadata is traceable.\u003c/li\u003e\n\u003cli\u003ePrepare to deploy official security patches from Red Hat or upstream CRI-O as soon as they become available to address CVE-2026-92574.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-21T10:27:54Z","date_published":"2026-09-21T10:27:54Z","id":"https://feed.craftedsignal.io/briefs/2026-09-crio-checkpoint-bypass/","summary":"A vulnerability in CRI-O checkpoint restore allows an authenticated user to bypass Kubernetes security context enforcement by leveraging a malicious checkpointed container, leading to potential privilege escalation.","title":"CRI-O Checkpoint Restore Security Context Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-crio-checkpoint-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenShift Container Platform (\u003e= 4.17)","version":"https://jsonfeed.org/version/1.1"}