CVE-2026-76061: CRI-O Privilege Escalation Vulnerability

CVE-2026-76061 Overview

CVE-2026-76061 is a symlink-handling flaw in the CRI-O container runtime affecting the bind_mount_prefix configuration. When CRI-O is configured with a non-empty bind_mount_prefix, a malicious container or local attacker can craft a Container Runtime Interface (CRI) hostPath that contains an intermediate absolute symlink. The resolver fails to confine the resolved path to the configured prefix, allowing the bind mount source to escape outside the intended prefixed root. This can expose files on the host or enable privilege escalation. The weakness is classified as [CWE-59] (Improper Link Resolution Before File Access, or "Link Following").

Critical Impact
A local attacker with container workload access can bypass the bind_mount_prefix sandbox and mount arbitrary host paths into a container, enabling unauthorized file access or privilege escalation on the host.

Affected Products

CRI-O container runtime (releases prior to the fixed commits)
Deployments configuring a non-empty bind_mount_prefix
Red Hat OpenShift and Kubernetes clusters using affected CRI-O builds

Discovery Timeline

2026-10-06 - CVE CVE-2026-76061 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-76061

Vulnerability Analysis

CRI-O supports a bind_mount_prefix configuration option that prepends a filesystem prefix to every host path a container requests via the CRI hostPath field. The intent is to constrain mount sources to a controlled subtree on the host, acting as a chroot-style sandbox for mount resolution.

The pre-patch resolveSymbolicLink function used os.Lstat on the joined path and resolved only the final symlink component. Intermediate absolute symlinks were followed by the kernel without being re-confined to the configured scope. An attacker who could influence the hostPath value, or plant a symlink inside the prefixed root, could cause the resolved source to point outside the prefix and into an arbitrary location on the host filesystem.

Root Cause

The root cause is incomplete path confinement during symlink resolution. The legacy helper relied on filepath.Join plus a terminal Lstat check, which does not account for absolute symlinks encountered mid-path. Because the resolver did not use a scoped join such as securejoin.SecureJoin against the bind_mount_prefix, any intermediate link that pointed to an absolute path escaped the prefix boundary.

Attack Vector

Exploitation requires local access with the ability to create pods or containers that specify hostPath volumes, or the ability to write symlinks beneath the configured bind_mount_prefix. The attacker crafts a hostPath whose intermediate component is an absolute symlink resolving outside the prefixed root. CRI-O then bind-mounts the external source into the container, exposing sensitive host files such as credentials, kubelet configuration, or container runtime sockets, which can be chained for privilege escalation.

// Patch excerpt: server/container_create.go
// resolveSymbolicLink confines path to scope. With an empty or root scope,
// it preserves the legacy behavior of only resolving a final symlink.
// On os.IsNotExist errors it returns the source path for the caller to create.
func resolveSymbolicLink(scope, path string) (string, error) {
	if scope == "" || scope == "/" {
		path = filepath.Join(scope, path)

		info, err := os.Lstat(path)
		if err != nil {
			return path, err
		}

		// Preserve kernel resolution of intermediate symlinks, including
		// /proc magic links that refer to another process's filesystem.
		if info.Mode()&os.ModeSymlink == 0 {
			return path, nil
		}

		return securejoin.SecureJoin("/", path)
	}
// Source: [CRI-O Commit Fix](https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b)

Detection Methods for CVE-2026-76061

Indicators of Compromise

Bind mounts whose resolved source path lies outside the configured bind_mount_prefix directory tree.
Container hostPath specifications that reference paths traversing symlinks under the prefix root.
Unexpected read or write access from container processes to sensitive host files such as /etc/shadow, kubelet credentials, or /var/run/crio/crio.sock.

Detection Strategies

Audit CRI-O runtime logs for failed to resolve symlink errors and for mount sources that do not begin with the configured bind_mount_prefix.
Enforce Kubernetes admission policies (OPA/Gatekeeper, Kyverno, or Pod Security Admission) that restrict or deny hostPath volumes.
Compare the requested hostPath against the final mount source recorded by CRI-O to detect prefix escapes.

Monitoring Recommendations

Monitor host filesystem events under the bind_mount_prefix root for symlink creation by non-trusted users or workloads.
Alert on container processes accessing host paths outside their declared volume scope using Linux audit (auditd) or eBPF-based file access telemetry.
Track CRI-O version inventory across cluster nodes to confirm patched builds are deployed.

How to Mitigate CVE-2026-76061

Immediate Actions Required

Upgrade CRI-O to a release containing the fix commits 01f90366, 6d08a9a6, or d6f58973.
Review /etc/crio/crio.conf and any drop-in overrides for a non-empty bind_mount_prefix setting and audit the prefix contents for attacker-writable symlinks.
Restrict pod creation privileges and deny hostPath volumes for untrusted tenants via admission control.

Patch Information

The fix rewrites resolveSymbolicLink to confine resolution to the configured scope using securejoin.SecureJoin, ensuring intermediate symlinks cannot escape the bind_mount_prefix. See the Red Hat CVE Details, the Red Hat Bug Report, and upstream commits 01f90366, 6d08a9a6, and d6f58973.

Workarounds

Set bind_mount_prefix to an empty value or / if the deployment does not strictly require prefixed mount confinement, reverting to legacy final-symlink-only resolution semantics.
Ensure the directory tree under bind_mount_prefix is owned by root and not writable by container workloads or unprivileged users, eliminating attacker-controlled symlinks.
Disable or restrict hostPath volumes cluster-wide using Pod Security Admission restricted profile until patched CRI-O is deployed.

bash

# Example Kyverno policy snippet to deny hostPath volumes
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-hostpath
spec:
  validationFailureAction: Enforce
  rules:
    - name: no-hostpath
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "hostPath volumes are not allowed."
        pattern:
          spec:
            =(volumes):
              - X(hostPath): "null"