CVE-2026-76061
mediumA flaw was found in CRI-O's `bind_mount_prefix` handling.
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
CVSS
5.5
5.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2026-10-06 20:17
Modified: 2026-10-09 02:17
NVD status: Awaiting Analysis
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://access.redhat.com/security/cve/CVE-2026-76061 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2520330 secalert@redhat.com
- https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70 secalert@redhat.com
- https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40 secalert@redhat.com
- https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗