CVE-2026-15801: CRI-O Path Traversal Vulnerability

CVE-2026-15801 Overview

CVE-2026-15801 is a path traversal vulnerability [CWE-22] in CRI-O, the Kubernetes Container Runtime Interface implementation for Open Container Initiative (OCI) runtimes. The flaw resides in the container checkpoint and restore feature. CRI-O fails to properly validate restore metadata when reconstructing containers from checkpoint archives. A privileged user who can trigger restoration of an attacker-controlled checkpoint may perform unintended operations on the host filesystem. The vulnerability requires that checkpoint and restore functionality is explicitly enabled, which is not the default configuration.

Critical Impact
Successful exploitation allows a high-privileged actor to write outside the intended restore directory, compromising host confidentiality, integrity, and availability with scope change beyond the container boundary.

Affected Products

CRI-O container runtime deployments with checkpoint and restore functionality enabled
Red Hat OpenShift Container Platform configurations that expose CRI-O checkpoint restore
Kubernetes clusters that permit restoration of container checkpoints from untrusted sources

Discovery Timeline

2026-09-21 - CVE-2026-15801 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-15801

Vulnerability Analysis

The vulnerability affects the container checkpoint and restore workflow in CRI-O. Checkpoint and restore lets operators serialize a running container's state into an archive and later reconstitute it. CRI-O consumes checkpoint metadata that describes files, mount points, and runtime configuration required to restart the container.

CRI-O does not sufficiently sanitize path components inside restore metadata. When the runtime extracts and applies checkpoint content, crafted entries can reference locations outside the intended restore root. The scope change reflected in the CVSS vector confirms that impact crosses the container isolation boundary and reaches host filesystem resources.

Exploitation requires high privileges on the CRI-O node and the ability to supply untrusted checkpoint content. The attack complexity is high because the operator must have checkpoint and restore explicitly enabled and must trigger a restore from attacker-influenced input.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Restore metadata paths are trusted without canonicalization or containment checks against the intended restore root. Traversal sequences and absolute paths embedded in checkpoint archives are honored during file operations on the host.

Attack Vector

An attacker with sufficient privileges introduces a malicious checkpoint archive into a workflow that CRI-O will restore. When CRI-O processes the archive, the crafted metadata directs file writes or references to host filesystem locations outside the container. This can be leveraged to overwrite configuration, drop payloads into privileged paths, or otherwise manipulate the host. No user interaction is required once restore is triggered. Refer to the Red Hat CVE-2026-15801 Advisory and Red Hat Bug Report #2500823 for additional technical context.

Detection Methods for CVE-2026-15801

Indicators of Compromise

Unexpected files written outside the CRI-O restore working directory or standard container storage roots such as /var/lib/containers/storage
CRI-O log entries showing checkpoint restore operations sourced from untrusted or unusual paths
Modifications to sensitive host paths (for example /etc, /usr/bin, or kubelet configuration) correlated in time with crictl restore activity

Detection Strategies

Audit CRI-O configuration for enable_criu_support and any restore-enabling flags, and alert when these are set on production nodes
Monitor invocations of crictl checkpoint and crictl restore and correlate them with the origin of the checkpoint archive
Inspect checkpoint archive contents for path entries containing .. sequences or absolute paths that escape the container root

Monitoring Recommendations

Enable Linux audit rules on host directories that should never be modified by container runtimes and forward events to a central SIEM
Track file integrity on kubelet, CRI-O, and OCI runtime binaries and configuration files on all worker nodes
Alert on new or modified checkpoint archives appearing in shared storage that feeds cluster restore operations

How to Mitigate CVE-2026-15801

Immediate Actions Required

Disable CRI-O container checkpoint and restore functionality on any node where it is not operationally required
Restrict privileges that allow triggering checkpoint restore to a minimal set of trusted cluster administrators
Treat all checkpoint archives from outside the cluster boundary as untrusted and block their ingestion pending validation

Patch Information

Apply the vendor-supplied updates referenced in the Red Hat CVE-2026-15801 Advisory. Track fix availability for your CRI-O distribution and update all worker nodes in the cluster. Verify runtime version after patching using crio --version and confirm the fix is present before re-enabling checkpoint restore.

Workarounds

Leave checkpoint and restore disabled in CRI-O configuration until patched builds are deployed across the cluster
Enforce admission policies that reject pod specifications requesting restore from external checkpoint sources
Isolate nodes that must retain checkpoint restore behind stricter role-based access control and network segmentation

bash

# Verify checkpoint restore is disabled in CRI-O configuration
grep -R "enable_criu_support" /etc/crio/ /etc/crio/crio.conf.d/ 2>/dev/null

# Restart CRI-O after ensuring checkpoint restore is disabled
sudo systemctl restart crio

# Confirm running version includes the vendor patch
crio --version