{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/cri-o/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cri-o:cri-o:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-15801"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CRI-O"],"_cs_severities":["high"],"_cs_tags":["vulnerability","container-security","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["CRI-O"],"content_html":"\u003cp\u003eCVE-2026-15801 is a security vulnerability identified in the CRI-O container runtime, specifically impacting the optional container checkpoint and restore functionality. The vulnerability arises from improper validation of metadata contained within checkpoint archives during the restoration process. If an administrator has explicitly enabled the non-default checkpoint and restore feature, an attacker with sufficient privileges to interact with the container runtime can supply a maliciously crafted checkpoint archive. This allows the attacker to manipulate the host filesystem beyond the intended scope of the container's isolated environment. Because this feature is not enabled by default, organizations only face risk if they have modified their CRI-O configuration to support container migration or state snapshots. Defenders should audit their container host configurations to identify if this feature is in use.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits an attacker to escape container isolation constraints, leading to unauthorized read or write access to the host filesystem. This could result in host compromise, persistence establishment, or the modification of sensitive system files. The scope of impact is limited to environments where the non-default checkpoint and restore functionality is active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all CRI-O container runtime configurations to determine if the checkpoint and restore feature is enabled.\u003c/li\u003e\n\u003cli\u003eDisable the checkpoint and restore feature in CRI-O unless it is strictly required for business operations.\u003c/li\u003e\n\u003cli\u003eApply security patches or updates for CRI-O provided by the vendor or distribution maintainer to address the metadata validation logic flaw in CVE-2026-15801.\u003c/li\u003e\n\u003cli\u003eImplement strict RBAC controls to ensure that only highly trusted users have the authorization to trigger container checkpoint and restore operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-21T12:28:17Z","date_published":"2026-09-21T12:28:17Z","id":"https://feed.craftedsignal.io/briefs/2026-09-crio-checkpoint-vuln/","summary":"A vulnerability in the CRI-O container checkpoint and restore feature (CVE-2026-15801) allows an authenticated user to perform unauthorized host filesystem operations through insufficient metadata validation.","title":"CRI-O Checkpoint and Restore Metadata Validation Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-crio-checkpoint-vuln/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-92574"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CRI-O (\u003e= 1.34)","OpenShift Container Platform (\u003e= 4.17)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","kubernetes","container-security","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Red Hat","CRI-O"],"content_html":"\u003cp\u003eCVE-2026-92574 describes a security flaw within the CRI-O container runtime checkpoint/restore mechanism. The vulnerability exists when a user with permissions to create pods utilizes a malicious checkpointed container image to initialize a new pod. During the restoration process, the runtime fails to properly apply the destination pod's intended Kubernetes security context.\u003c/p\u003e\n\u003cp\u003eInstead of enforcing the security settings defined in the new pod specification, the restored process inherits critical security state artifacts from the original checkpoint, including Linux capabilities, user credentials, no_new_privs flags, and seccomp profiles. This effectively allows an attacker to bypass container isolation and execute code with elevated privileges that were intended to be restricted. The vulnerability affects CRI-O version 1.34 and later, as well as Red Hat OpenShift Container Platform version 4.17 and subsequent releases. Impacted environments are those where checkpoint restore functionality is enabled and reachable by users capable of pod creation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits unauthorized privilege escalation within a containerized environment. By bypassing established Kubernetes security contexts, an attacker can gain capabilities or permissions that were explicitly revoked in the destination pod configuration. This compromises container isolation boundaries, potentially allowing for cross-container lateral movement or host-level escalation if the inherited security state provides sufficient privileges. The scope of impact is limited to Kubernetes clusters utilizing affected CRI-O runtimes with checkpoint functionality enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and platform engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit all Kubernetes clusters running CRI-O 1.34+ or OCP 4.17+ where checkpoint/restore functionality is enabled.\u003c/li\u003e\n\u003cli\u003eRestrict pod creation permissions (RBAC) to only trusted identities, as this is a prerequisite for exploitation of CVE-2026-92574.\u003c/li\u003e\n\u003cli\u003eMonitor Kubernetes audit logs for pod creation requests involving unusual image sources or specific checkpoint-related APIs.\u003c/li\u003e\n\u003cli\u003eMonitor for the deployment of pods with security contexts that conflict with the image's source characteristics if such metadata is traceable.\u003c/li\u003e\n\u003cli\u003ePrepare to deploy official security patches from Red Hat or upstream CRI-O as soon as they become available to address CVE-2026-92574.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-21T10:27:54Z","date_published":"2026-09-21T10:27:54Z","id":"https://feed.craftedsignal.io/briefs/2026-09-crio-checkpoint-bypass/","summary":"A vulnerability in CRI-O checkpoint restore allows an authenticated user to bypass Kubernetes security context enforcement by leveraging a malicious checkpointed container, leading to potential privilege escalation.","title":"CRI-O Checkpoint Restore Security Context Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-crio-checkpoint-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - CRI-O","version":"https://jsonfeed.org/version/1.1"}